theory Tcb_C

lemma decodeSetSpace_ccorres:
  notes tl_drop_1[simp] scast_mask_8 [simp]
  shows
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple
              and valid_cap' cp and cte_at' slot and K (isThreadCap cp)
              and tcb_at' (capTCBPtr cp)
              and (\<lambda>s. \<forall>rf \<in> zobj_refs' cp. ex_nonz_cap_to' rf s)
              and (excaps_in_mem extraCaps o ctes_of)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             s \<turnstile>' fst v \<and> cte_at' (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and sysargs_rel args buffer)
       (UNIV
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. slot_' s = cte_Ptr slot}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeSetSpace args cp slot extraCaps
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeSetSpace_'proc)" supply unsigned_numeral[simp del] apply (cinit' lift: cap_' length___unsigned_long_' slot_' current_extra_caps_' buffer_'
                simp: decodeSetSpace_def) apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (simp add: if_1_0_0) apply (rule ccorres_cond_true_seq | simp)+ apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (subgoal_tac "unat length___unsigned_long < 3") apply (clarsimp simp: throwError_def invocationCatch_def fst_return
                           intr_and_se_rel_def syscall_error_rel_def
                           syscall_error_to_H_cases exception_defs
                           subset_iff
                    split: list.split) apply unat_arith apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (simp add: if_1_0_0 interpret_excaps_test_null excaps_map_Nil) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: throwError_def invocationCatch_def fst_return
                          intr_and_se_rel_def syscall_error_rel_def
                          syscall_error_to_H_cases exception_defs
                   split: list.split) apply csymbr apply (simp add: if_1_0_0 interpret_excaps_test_null del: Collect_const) apply (rule_tac P="\<lambda>c. ccorres rvr xf P P' hs a (Cond c c1 c2 ;; c3)" for rvr xf P P' hs a c1 c2 c3 in ssubst) apply (rule Collect_cong) apply (rule interpret_excaps_test_null) apply (clarsimp simp: neq_Nil_conv) apply simp apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: throwError_def invocationCatch_def fst_return
                          intr_and_se_rel_def syscall_error_rel_def
                          syscall_error_to_H_cases exception_defs
                          excaps_map_def
                   split: list.split) apply (clarsimp simp add: linorder_not_less word_le_nat_alt
                             excaps_map_Nil length_excaps_map
                   simp del: Collect_const) apply (drule_tac a="Suc 0" in neq_le_trans [OF not_sym]) apply (clarsimp simp: neq_Nil_conv) apply (rule_tac P="\<lambda>a. ccorres rvr xf P P' hs a c" for rvr xf P P' hs c in ssubst,
          rule bind_cong [OF _ refl], rule list_case_helper,
          clarsimp)+ apply (simp add: hd_drop_conv_nth2 del: Collect_const) apply (rule ccorres_add_return,
          ctac add: getSyscallArg_ccorres_foo[where args=args and n=0 and buffer=buffer]) apply (rule ccorres_add_return,
            ctac add: getSyscallArg_ccorres_foo[where args=args and n=1 and buffer=buffer]) apply (rule ccorres_add_return,
              ctac add: getSyscallArg_ccorres_foo[where args=args and n=2 and buffer=buffer]) apply csymbr apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply ctac apply (rule ccorres_assert2) apply csymbr apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=1]) apply (rule ccorres_move_c_guard_cte) apply ctac apply (rule ccorres_assert2) apply csymbr apply (simp add: decodeSetSpace_def injection_bindE[OF refl]
                              split_def
                              tcb_cnode_index_defs[THEN ptr_add_assertion_positive[OF ptr_add_assertion_positive_helper]]
                         del: Collect_const) apply (rule ccorres_move_array_assertion_tcb_ctes ccorres_Guard_Seq
                         ccorres_rhs_assoc)+ apply (simp add: injection_liftE[OF refl] bindE_assoc
                              liftM_def getThreadCSpaceRoot
                              getThreadVSpaceRoot del: Collect_const) apply (simp add: liftE_bindE bind_assoc del: Collect_const) apply (ctac add: slotCapLongRunningDelete_ccorres) apply (rule ccorres_move_array_assertion_tcb_ctes) apply (simp del: Collect_const) apply csymbr apply (clarsimp simp add: if_1_0_0 from_bool_0
                               simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_symb_exec_l [OF _ _ _ empty_fail_slotCapLongRunningDelete]) apply (simp add: unlessE_def throwError_bind invocationCatch_def
                             cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule ccorres_cond_true_seq) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply wp+ apply (rule ccorres_rhs_assoc)+ apply csymbr apply (simp add: tcb_cnode_index_defs[THEN ptr_add_assertion_positive[OF ptr_add_assertion_positive_helper]]
                          del: Collect_const) apply (rule ccorres_move_array_assertion_tcb_ctes ccorres_Guard_Seq
                          ccorres_rhs_assoc)+ apply (ctac add: slotCapLongRunningDelete_ccorres) apply (rule ccorres_move_array_assertion_tcb_ctes) apply (simp del: Collect_const) apply csymbr apply (clarsimp simp add: if_1_0_0 from_bool_0
                                 simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: unlessE_def throwError_bind invocationCatch_def
                             cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: unlessE_def
                             del: Collect_const) apply (rule ccorres_add_return,
                        rule_tac r'="\<lambda>rv rv'. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps)
                                           else updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'"
                             and xf'="cRootCap_'" in ccorres_split_nothrow) apply (rule_tac P'="{s. cRootCap = cRootCap_' s}"
                                 in ccorres_from_vcg[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (subgoal_tac "extraCaps \<noteq> []") apply (clarsimp simp: returnOk_def return_def hd_conv_nth) apply fastforce apply clarsimp apply ceqv apply (simp add: invocationCatch_use_injection_handler
                                    injection_bindE [OF refl refl] bindE_assoc
                               del: Collect_const) apply (ctac add: ccorres_injection_handler_csum1
                                              [OF deriveCap_ccorres]) apply (simp add: Collect_False del: Collect_const) apply csymbr apply csymbr apply (simp add: cnode_cap_case_if cap_get_tag_isCap
                                  del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: injection_handler_throwError
                                  cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: injection_handler_returnOk del: Collect_const) apply (rule ccorres_add_return,
                             rule_tac r'="\<lambda>rv rv'. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0)
                                                else updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'"
                                  and xf'="vRootCap_'" in ccorres_split_nothrow) apply (rule_tac P'="{s. vRootCap = vRootCap_' s}"
                                  in ccorres_from_vcg[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def hd_drop_conv_nth2) apply fastforce apply ceqv apply (ctac add: ccorres_injection_handler_csum1
                                             [OF deriveCap_ccorres]) apply (simp add: Collect_False del: Collect_const) apply csymbr apply csymbr apply (simp add: from_bool_0 isValidVTableRoot_conv del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: injection_handler_throwError
                                        cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: injection_handler_returnOk ccorres_invocationCatch_Inr
                                             performInvocation_def) apply (ctac add: setThreadState_ccorres) apply csymbr apply csymbr apply (ctac(no_vcg) add: invokeTCB_ThreadControl_ccorres) apply simp apply (rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+)[1] apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply simp apply (wp sts_invs_minor') apply (vcg exspec=setThreadState_modifies) apply simp apply (rule ccorres_split_throws, rule ccorres_return_C_errorE, simp+) apply vcg apply simp apply (wp hoare_drop_imps) apply (wp injection_wp_E [OF refl]) apply (simp add: Collect_const_mem cintr_def intr_and_se_rel_def
                                         all_ex_eq_helper syscall_error_rel_def
                                         exception_defs) apply (vcg exspec=deriveCap_modifies) apply (simp cong: if_cong) apply wp apply (simp add: Collect_const_mem all_ex_eq_helper) apply vcg apply simp apply (rule ccorres_split_throws, rule ccorres_return_C_errorE, simp+) apply vcg apply (simp cong: if_cong) apply (wp hoare_drop_imps injection_wp_E[OF refl]) apply (simp add: Collect_const_mem all_ex_eq_helper
                                    numeral_eqs syscall_error_rel_def
                                    exception_defs cintr_def intr_and_se_rel_def) apply (vcg exspec=deriveCap_modifies) apply (simp cong: if_cong) apply wp apply (simp add: Collect_const_mem all_ex_eq_helper
                                  numeral_eqs syscall_error_rel_def
                                  exception_defs cintr_def intr_and_se_rel_def
                                  hd_drop_conv_nth2
                            cong: if_cong) apply vcg apply (simp cong: if_cong) apply (wp hoare_drop_imps) apply (simp add: Collect_const_mem) apply (vcg exspec=slotCapLongRunningDelete_modifies) apply (simp cong: if_cong) apply (wp hoare_drop_imps) apply (simp add: Collect_const_mem all_ex_eq_helper
                              numeral_eqs syscall_error_rel_def
                              exception_defs cintr_def intr_and_se_rel_def) apply (vcg exspec=slotCapLongRunningDelete_modifies) apply (simp add: pred_conj_def cong: if_cong) apply (strengthen if_n_updateCapData_valid_strg) apply (wp hoare_drop_imps) apply (simp add: Collect_const_mem all_ex_eq_helper
                            numeral_eqs syscall_error_rel_def
                            exception_defs cintr_def intr_and_se_rel_def) apply vcg apply simp apply (wp hoare_drop_imps) apply (simp add: Collect_const_mem all_ex_eq_helper
                          numeral_eqs syscall_error_rel_def
                          exception_defs cintr_def intr_and_se_rel_def) apply vcg apply simp apply (wp hoare_drop_imps) apply (simp add: Collect_const_mem all_ex_eq_helper
                        numeral_eqs syscall_error_rel_def
                        exception_defs cintr_def intr_and_se_rel_def
                  cong: if_cong
                | vcg exspec=getSyscallArg_modifies
                | wp)+ apply (clarsimp simp: word_less_nat_alt) apply (rule conjI) apply (clarsimp simp: ct_in_state'_def interpret_excaps_test_null
                         excaps_map_def neq_Nil_conv) apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (rule conjI, clarsimp simp: sysargs_rel_n_def n_msgRegisters_def) apply (frule(2) tcb_at_capTCBPtr_CL) apply (auto simp: isCap_simps valid_tcb_state'_def objBits_defs mask_def
              elim!: pred_tcb'_weakenE
              dest!: st_tcb_at_idle_thread' interpret_excaps_eq)[1] apply (clarsimp simp: linorder_not_le interpret_excaps_test_null
                        excaps_map_def neq_Nil_conv word_sle_def
                        word_sless_def) apply (frule interpret_excaps_eq[rule_format, where n=0], simp) apply (frule interpret_excaps_eq[rule_format, where n=1], simp) apply (clarsimp simp: mask_def[where n=4] ccap_rights_relation_def
                        rightsFromWord_wordFromRights
                        capTCBPtr_eq tcb_cnode_index_defs size_of_def
                        option_to_0_def rf_sr_ksCurThread
                        "StrictC'_thread_state_defs" mask_eq_iff_w2p word_size) apply (simp add: word_sle_def cap_get_tag_isCap) apply (subgoal_tac "args \<noteq> []") apply (fastforce simp: hd_conv_nth objBits_defs) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeSetSpace args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeSetSpace_'proc) proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeSetSpace args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeSetSpace_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7368 buffera current_extra_caps slota length___unsigned_long cap) (?Q'7368 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long < 3 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q7368 buffera current_extra_caps slota length___unsigned_long cap s \<and> s' \<in> ?Q'7368 buffera current_extra_caps slota length___unsigned_long cap proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7368 buffera current_extra_caps slota length___unsigned_long cap) (?G'7376 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q7368 buffera current_extra_caps slota length___unsigned_long cap s \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> ?G'7376 buffera current_extra_caps slota length___unsigned_long cap} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7597 buffera current_extra_caps slota length___unsigned_long cap) (?S7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7597 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S7597 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7597 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S7597 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7597 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S7597 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7597 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?R'7625 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7597 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?R'7625 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7630 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> ?R'7630 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3; unat length___unsigned_long < 3\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> unat length___unsigned_long < 3
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 3\<rbrakk> \<Longrightarrow> unat length___unsigned_long < 3
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?T7597 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7597 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7597 buffera current_extra_caps slota length___unsigned_long cap) (?G'7745 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7597 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'7745 buffera current_extra_caps slota length___unsigned_long cap})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7961 buffera current_extra_caps slota length___unsigned_long cap) (?S7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7961 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S7961 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; extraCaps = []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7961 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S7961 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; extraCaps = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'7981 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI {},UNIV
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; extraCaps = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> ?R'7981 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; extraCaps = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; extraCaps = []\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (ret__int_' s \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>)))) \<and> (\<not> ret__int_' s \<noteq> 0 \<longrightarrow> True)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; extraCaps = []; (\<sigma>, x) \<in> rf_sr; ret__int_' x \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case [] of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals x)))) x\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?T7961 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7961 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0; \<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 buffera current_extra_caps slota length___unsigned_long cap) (?G'8049 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,SCAST(32 signed \<rightarrow> 32) 0,\<acute>ret__struct_cap_C,PTR_COERCE(unit \<rightarrow> cte_C) (PTR(unit) (SCAST(32 signed \<rightarrow> 32) 0)),SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'8049 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF excaprefs_C extraCaps'.[Suc 0] = NULL THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrace> = ?s8481 buffera current_extra_caps slota length___unsigned_long cap
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'8049 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Cond (?s8481 buffera current_extra_caps slota length___unsigned_long cap) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)) SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> (excaprefs_C extraCaps'.[Suc 0] = NULL) = ?Q8488 buffera current_extra_caps slota length___unsigned_long cap s
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'8049 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF \<acute>(?Q8488 buffera current_extra_caps slota length___unsigned_long cap) THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> Suc 0 \<le> length (interpret_excaps extraCaps')
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> Suc 0 < 3
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'8049 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length (interpret_excaps extraCaps') = Suc 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> Suc 0 < 3
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'8049 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length (interpret_excaps extraCaps') = Suc 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R7961 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'8049 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length (interpret_excaps extraCaps') = Suc 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7961 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'8049 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') = Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8504 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S8507 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> ?Q8504 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> ?S8507 buffera current_extra_caps slota length___unsigned_long cap) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') = Suc 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8514 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') = Suc 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> ?R'8514 buffera current_extra_caps slota length___unsigned_long cap) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') = Suc 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') = Suc 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals s)))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (excaps_map extraCaps) = Suc 0; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) (current_syscall_error_' (globals x)))) x\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 3; excaps_map extraCaps \<noteq> []; length (interpret_excaps extraCaps') \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; length extraCaps \<noteq> Suc 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> Suc 0 \<le> length extraCaps
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # x \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRootArg] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRootArg # vRootArg # xa \<Rightarrow> doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk cRootArg;
cRootCap' <- global.deriveCap cRootSlot $ if cRootData = 0 then cRootCap else global.updateCapData False cRootData cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk vRootArg;
vRootCap' <- global.deriveCap vRootSlot $ if vRootData = 0 then vRootCap else global.updateCapData False vRootData vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr faultEP) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] (doE canChangeCRoot <- withoutFailure $ liftM Not $ getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
canChangeVRoot <- withoutFailure $ liftM Not $ getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete;
unlessE (canChangeCRoot \<and> canChangeVRoot) $ throw Fault_H.syscall_error.IllegalOperation;
(cRootCap, cRootSlot) <- returnOk (hd extraCaps);
cRootCap' <- global.deriveCap cRootSlot $ if hd (tl args) = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap;
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
(vRootCap, vRootSlot) <- returnOk (hd (tl extraCaps));
vRootCap' <- global.deriveCap vRootSlot $ if hd (tl (tl args)) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap;
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) slot (Just $ CPtr (hd args)) Nothing Nothing (Just cRoot) (Just vRoot) Nothing
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R8503 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T8505 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> ?R8503 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> ?T8505 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q8703 length___unsigned_long cap rv) (?Q'8703 length___unsigned_long cap rv faultEP) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>?Q8703 length___unsigned_long cap\<rbrace>
 3. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> ?Q'8703 length___unsigned_long cap rv (faultEP_' s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9664 length___unsigned_long cap rv faultEP rva) (?Q'9664 length___unsigned_long cap rv faultEP rva cRootData) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>?Q9664 length___unsigned_long cap rv faultEP\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> ?Q'9664 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 4. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 5. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10561 length___unsigned_long cap rv faultEP rva cRootData rvb) (?Q'10561 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>?Q10561 length___unsigned_long cap rv faultEP rva cRootData\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> ?Q'10561 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s)}
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10561 length___unsigned_long cap rv faultEP rva cRootData rvb) (?G'11431 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>?Q10561 length___unsigned_long cap rv faultEP rva cRootData\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?G'11431 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s)}}
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P12275 length___unsigned_long cap rv faultEP rva cRootData rvb) (?G'11431 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P12275 length___unsigned_long cap rv faultEP rva cRootData rvb s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?G'11431 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s)}}
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A12278 length___unsigned_long cap rv faultEP rva cRootData rvb) (?C'12277 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A12278 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?C'12277 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc) (?Q'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) [SKIP] (do _ <- assert (rvc = fst (extraCaps ! 0));
doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> ?Q'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s)}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G12723 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc) (?G'12721 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ?G12723 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'12721 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s)}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G12723 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc) (?G'12727 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ?G12723 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> ?G'12727 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s)}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P13535 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc) (?G'12727 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 1));
_ <- assert (rv = fst (extraCaps ! 1));
doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ?P13535 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> ?G'12727 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s)}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A13538 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc) (?C'13537 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 1));
_ <- assert (rv = fst (extraCaps ! 1));
doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']));;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> (?A13538 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> ?C'13537 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0); ccap_relation rvd vRootCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd) (?Q'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd vRootCap) [SKIP] (do _ <- assert (rvd = fst (extraCaps ! 1));
doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>?Q13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> ?Q'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s)}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0); ccap_relation rvd vRootCap; rvd = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G14112 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd) (?G'14110 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd vRootCap) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> ?G14112 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> ?G'14110 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s)}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0); ccap_relation rvd vRootCap; rvd = fst (extraCaps ! 1); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G14112 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd) (?G'14117 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd vRootCap ret__unsigned) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
case hd extraCaps of (cRootCap, cRootSlot) \<Rightarrow> doE cRootCap' <- global.deriveCap cRootSlot (if args ! Suc 0 = 0 then cRootCap else global.updateCapData False (hd (tl args)) cRootCap);
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', cRootSlot) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
case extraCaps ! Suc 0 of (vRootCap, vRootSlot) \<Rightarrow> doE vRootCap' <- global.deriveCap vRootSlot (if args ! Suc (Suc 0) = 0 then vRootCap else global.updateCapData False (hd (tl (tl args))) vRootCap);
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', vRootSlot) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE
odE
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> ?G14112 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'14117 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G14112 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))) (?G'14117 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> ?G14112 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'14117 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14386 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))) (?C'14383 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE canChangeCRoot <- liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
canChangeVRoot <- liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete));
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (?A14386 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'14383 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14386 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))) (?C'14383 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (doE canChangeCRoot <- liftE (do x <- slotCapLongRunningDelete (capTCBPtr cp);
return (\<not> x)
od);
canChangeVRoot <- liftE (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
return (\<not> x)
od);
y <- unlessE (canChangeCRoot \<and> canChangeVRoot) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (?A14386 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'14383 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14386 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))) (?C'14383 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp);
xa <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> x \<and> \<not> xa) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (?A14386 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'14383 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); ((=) \<circ> from_bool) rv ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14397 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv) (?Q'14397 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>?Q14397 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'14397 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s)}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); ((=) \<circ> from_bool) rv ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14676 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv) (?C'14675 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. ?A14676 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'14675 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); from_bool rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14676 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?C'14675 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. ?A14676 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'14675 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); from_bool rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14676 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?G'14696 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF (if ret__unsigned_long \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. ?A14676 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'14696 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A14676 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?G'14696 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF rv THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. ?A14676 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'14696 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14944 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?S14946 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q14944 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> ?S14946 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s)) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14957 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv) rva) (?Q'14956 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv) rva) [SKIP] (doE y <- unlessE (\<not> rv \<and> \<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q14944 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q14957 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q14944 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q14957 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) rva sa \<longrightarrow> s' \<in> ?Q'14956 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) rva}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14957 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) True (SCAST(32 signed \<rightarrow> 32) true) rva) (?Q'14956 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) True (SCAST(32 signed \<rightarrow> 32) true) rva) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q14944 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q14957 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q14944 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q14957 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) rva sa \<longrightarrow> s' \<in> ?Q'14956 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) rva}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14957 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) True (SCAST(32 signed \<rightarrow> 32) true) rva) (?R'14975 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) True (SCAST(32 signed \<rightarrow> 32) true) rva) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q14944 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q14957 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q14944 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q14957 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) rva sa \<longrightarrow> s' \<in> ?R'14975 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) rva \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q14944 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>rva s. rv\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q14944 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q14944 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>rva s. rv\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q14944 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?T14945 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> ?T14945 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv) (?G'14998 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rv (from_bool rv) ret__unsigned) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> rv \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'14998 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R14943 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False) (?G'14998 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R14943 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'14998 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A15364 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False) (?C'15361 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE y <- unlessE (\<not> x) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
(Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (?A15364 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'15361 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); ((=) \<circ> from_bool) rva ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q15375 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva) (?Q'15375 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva ret__unsigned_long) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q15375 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'15375 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s)}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); ((=) \<circ> from_bool) rva ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A15875 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva) (?C'15874 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva ret__unsigned_long) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. ?A15875 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'15874 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); from_bool rva = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A15875 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?C'15874 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva ret__unsigned_long) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. ?A15875 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'15874 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); from_bool rva = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A15875 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?G'15895 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva ret__unsigned_long) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if ret__unsigned_long \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. ?A15875 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'15895 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A15875 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?G'15895 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva (from_bool rva)) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF rva THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. ?A15875 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'15895 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16513 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?S16516 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva (from_bool rva)) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16512 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?T16514 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva (from_bool rva)) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q16513 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R16512 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> ?S16516 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s)) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T16514 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16513 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) True) (?S16516 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) True (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16512 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?T16514 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva (from_bool rva)) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> ?Q16513 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b) \<and> (\<not> a \<longrightarrow> ?R16512 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> ?S16516 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s)) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T16514 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; rva\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16512 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?T16514 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva (from_bool rva)) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R16512 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T16514 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16512 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva) (?T16514 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) rva (from_bool rva)) [SKIP] (doE y <- unlessE (\<not> rva) (throwError Fault_H.syscall_error.IllegalOperation);
cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R16512 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T16514 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R16512 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False) (?T16514 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ?R16512 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T16514 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) cRootCap_' (?P16544 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False) (?P'16537 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (return ()) (IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI)
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (?P16544 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> ?P'16537 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s) \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s)}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', cRootCap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s)))}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', cRootCap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s)))}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> extraCaps \<noteq> []
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap vRootCap rv rva \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; extraCaps \<noteq> []; (\<sigma>, x) \<in> rf_sr; args ! Suc 0 \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (extraCaps ! 0))) (ret__struct_cap_C_' t))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> extraCaps \<noteq> []
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> extraCaps \<noteq> []
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (?d'16534 length___unsigned_long cap cRootCap vRootCap rv rva rv')
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb) (?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb rv') [SKIP] (doE cRootCap' <- global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)));
cRoot <- case cRootCap' of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (cRootCap', snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation;
vRootCap' <- global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)));
vRoot <- if isValidVTableRoot vRootCap' then returnOk (vRootCap', snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation;
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some cRoot) (Some vRoot) None)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16534 length___unsigned_long cap cRootCap vRootCap False False ()) (?Q'16534 length___unsigned_long cap cRootCap vRootCap False False () rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>?Q16534 length___unsigned_long cap cRootCap vRootCap rv rva\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16534 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
A total of 18 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb) (?Q'16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret) [SKIP] (doE x <- injection_handler Inl (case rvb of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvb, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (IF deriveCap_ret_C.status_C dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C dc_ret)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>?Q16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16754 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?Q'16754 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret) [SKIP] (doE x <- injection_handler Inl (case rvb of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvb, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (\<acute>cRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>?Q16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16754 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?G'17062 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret) [SKIP] (doE x <- injection_handler Inl (case rvb of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvb, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C dc_ret);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>?Q16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?G'17062 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16754 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?G'17507 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret ret__unsigned) [SKIP] (doE x <- injection_handler Inl (case rvb of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvb, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>?Q16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'17507 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16754 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?G'17507 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvb then returnOk (rvb, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (IF \<not> isCNodeCap rvb THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>?Q16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'17507 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17858 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?S17861 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvb then returnOk (rvb, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?T17859 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvb then returnOk (rvb, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> ?Q17858 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ?R17857 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?S17861 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?T17859 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17858 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?S17861 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?T17859 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvb then returnOk (rvb, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> ?Q17858 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ?R17857 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?S17861 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?T17859 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?T17859 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvb then returnOk (rvb, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ?R17857 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?T17859 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?T17859 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvb then returnOk (rvb, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None)) >>=E (invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB \<circ> Inr)
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ?R17857 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?T17859 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R17857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?T17859 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ?R17857 length___unsigned_long cap cRootCap vRootCap rv rva rv' a b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?T17859 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0)))) vRootCap_' (?P17889 length___unsigned_long cap cRootCap vRootCap False False rv' rvb) (?P'17882 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (return ()) (IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI)
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc) (?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> (?P17889 length___unsigned_long cap cRootCap vRootCap rv rva rv' a and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> ?P'17882 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s)}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc) (?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (args ! 2 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', vRootCap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t))))) \<and> (\<not> args ! 2 \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s)))}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc) (?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap rv rva rv' rvb dc_ret \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isCNodeCap rvb; (\<sigma>, x) \<in> rf_sr; args ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc) (?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc) (?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (?d'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a)
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc) (?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>?Q17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 23 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a rvd dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a rvd) (?Q'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a rvd dc_ret) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (IF deriveCap_ret_C.status_C dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C dc_ret)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?Q'18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (\<acute>vRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?G'18382 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(deriveCap_ret_C.cap_C dc_ret);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?G'18382 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot_C (deriveCap_ret_C.cap_C dc_ret))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?G'18628 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (IF ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'18628 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rvd)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?G'18628 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (from_bool (isValidVTableRoot rvd))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (IF \<not> isValidVTableRoot rvd THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'18628 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rvd); \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18827 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?S18830 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (from_bool (isValidVTableRoot rvd))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (\<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rvd); \<not> \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18826 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?T18828 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (from_bool (isValidVTableRoot rvd))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> ?Q18827 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ?R18826 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?S18830 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?T18828 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18827 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?S18830 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rvd); \<not> \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18826 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?T18828 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (from_bool (isValidVTableRoot rvd))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> ?Q18827 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ?R18826 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?S18830 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?T18828 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rvd); \<not> \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18826 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?T18828 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (from_bool (isValidVTableRoot rvd))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ?R18826 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?T18828 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rvd); \<not> \<not> isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18826 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?T18828 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (from_bool (isValidVTableRoot rvd))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rvd then returnOk (rvd, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some x) None))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ?R18826 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?T18828 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R18826 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd) (?T18828 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ?R18826 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> ?T18828 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc) (?Q'18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> ?Q'18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc) (?G'18908 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'18908 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc) (?G'19019 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None);
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],0,ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q18849 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> ?G'19019 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
A total of 28 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C rve ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rve = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C rve) (?Q'19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C rve ret__unsigned_long) [SKIP] (if rve = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rve isCall)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err) (?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) \<lbrace>?Q19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>, \<lbrace>?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) and (\<lambda>_. (Some (hd args) = None) = (Some (rvb, snd (hd extraCaps)) = None) \<and> (Some (rvb, snd (hd extraCaps)) = None) = (Some (rvd, snd (extraCaps ! Suc 0)) = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. rve = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va rve (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va err (ret__unsigned_long_' t) (errstate t)))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa xfdc ret__unsigned ret__struct_cap_C rve ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rve = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19099 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C []) (?Q'19099 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err) (?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) \<lbrace>?Q19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>, \<lbrace>?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) and (\<lambda>_. (Some (hd args) = None) = (Some (rvb, snd (hd extraCaps)) = None) \<and> (Some (rvb, snd (hd extraCaps)) = None) = (Some (rvd, snd (extraCaps ! Suc 0)) = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. rve = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va rve (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va err (ret__unsigned_long_' t) (errstate t)))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa xfdc ret__unsigned ret__struct_cap_C rve ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; rve = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19099 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C []) (?Q'19099 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) ret__struct_cap_C [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err) (?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) \<lbrace>?Q19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>, \<lbrace>?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) and (\<lambda>_. (Some (hd args) = None) = (Some (rvb, snd (hd extraCaps)) = None) \<and> (Some (rvb, snd (hd extraCaps)) = None) = (Some (rvd, snd (extraCaps ! Suc 0)) = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. rve = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va rve (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va err (ret__unsigned_long_' t) (errstate t)))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap; id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err) (?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_longa rvc xfdc ret__unsigned ret__struct_cap_C err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) and (\<lambda>_. (Some (hd args) = None) = (Some (rvb, snd (hd extraCaps)) = None) \<and> (Some (rvb, snd (hd extraCaps)) = None) = (Some (rvd, snd (extraCaps ! Suc 0)) = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {sa. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rvc (K rvc \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''19099 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long rvc (xfdc s) v va err (ret__unsigned_long_' t) (errstate t)))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc xfdc ret__unsigned ret__struct_cap_C. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap); cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigneda rv'a rvd dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) and (\<lambda>_. (Some (hd args) = None) = (Some (rvb, snd (hd extraCaps)) = None) \<and> (Some (rvb, snd (hd extraCaps)) = None) = (Some (rvd, snd (extraCaps ! Suc 0)) = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R19101 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long a\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvb, snd (hd extraCaps))) (Some (rvd, snd (extraCaps ! Suc 0))) None) and (\<lambda>_. (Some (hd args) = None) = (Some (rvb, snd (hd extraCaps)) = None) \<and> (Some (rvb, snd (hd extraCaps)) = None) = (Some (rvd, snd (extraCaps ! Suc 0)) = None) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>s. True \<and> True)\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R18857 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' rvd b \<and> cte_wp_at' (\<lambda>_. True) slot b\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R18857 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a a) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a rvd dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18850 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rvd dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va. cap_get_tag va = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := va\<rparr> \<in> {s. updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) thread_control_update_space) (bufferSrcSlot_'_update (\<lambda>_. NULL) (bufferCap_'_update (\<lambda>_. va) (bufferAddr_'_update (\<lambda>_. 0) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvb, snd (hd extraCaps)) \<noteq> None \<or> None \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst None)\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. rva = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rv (K rv \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) slot b)) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rvd \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'18850 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) slot b)) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a err) (?Q''18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a err rv'b dc_ret) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b);;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) slot b)) b)\<rbrace>, \<lbrace>?QE18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_reta ret__unsigned rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19264 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a err rv'b dc_ret) return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b) {},UNIV
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) slot b)) b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> ?R'19264 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) slot b)) b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R18071 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret)) ()\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a b. isValidVTableRoot a \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvb b \<and> valid_cap' a b \<and> cte_wp_at' (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R18071 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'19285 length___unsigned_long cap cRootCap vRootCap (ds_id False) (ds_id False) rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret)) ()\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>rv s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> (obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' rvb s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>_. True) slot s\<rbrace>, -
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> ?P'19285 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc a)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rv \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {sa. \<forall>t rvc. dc rvc (xfdc (sa\<lparr>globals := globals sa\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = option_to_0 (Some (hd args)) \<and> 0 = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> UCAST(8 \<rightarrow> 32) (fst x)) \<and> (case Some (rvb, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap (deriveCap_ret_C.cap_C dc_ret)) \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (option_to_0 (map_option snd (Some (rvb, snd (hd extraCaps))))) \<and> (case Some (rv, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap (deriveCap_ret_C.cap_C (dc_ret_' s))) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (option_to_0 (map_option snd (Some (rv, snd (extraCaps ! Suc 0))))) \<and> 0 = option_to_0 (map_option fst None) \<and> NULL = cte_Ptr (case None of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot) \<and> (case None of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap v) \<and> SCAST(32 signed \<rightarrow> 32) thread_control_update_space = (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if rva then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvb, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0) \<and> (\<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE = ret__unsigned_long_' t \<and> dc rvc (K rvc (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> intr_and_se_rel (Inr err) (id (ret__unsigned_long_' t)) (errstate (sa\<lparr>ret__unsigned_' := cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap), ret__struct_cap_C_' := v, globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>)))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rvb a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = 0; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18069 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret)) () rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) \<lbrace>deriveCap_ret_C.status_C \<acute>dc_ret = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<acute>dc_ret) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rvb a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'18069 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned rvc (vRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rvb a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rv. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)\<rbrace>}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R17887 length___unsigned_long cap cRootCap vRootCap False False rv' rvb\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> (obj_at' tcbQueued thread a \<longrightarrow> st_tcb_at' runnable' thread a) \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rvb a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rv. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)\<rbrace>}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and ?R17887 length___unsigned_long cap cRootCap vRootCap rv rva rv' a) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rv. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)\<rbrace>}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b))) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvb (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F17879 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))\<^esub> (?R'17881 length___unsigned_long cap cRootCap vRootCap False False rv' rvb dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP \<lbrace>ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) \<acute>vRootCap \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) \<acute>vRootCap \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b))) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvb \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'17881 length___unsigned_long cap cRootCap vRootCap rv rva rv' rvb (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 10. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b))) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rv \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE16754 length___unsigned_long cap cRootCap vRootCap False False rv' err) (?Q''16754 length___unsigned_long cap cRootCap vRootCap False False rv' err rv'a dc_ret) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a);;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],0,\<acute>ret__struct_cap_C,NULL,SCAST(32 signed \<rightarrow> 32) thread_control_update_space);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b))) b)\<rbrace>, \<lbrace>?QE16754 length___unsigned_long cap cRootCap vRootCap rv rva rv'\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rv \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''16754 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19453 length___unsigned_long cap cRootCap vRootCap False False rv' err rv'a dc_ret) return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a) {},UNIV
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b))) b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rv \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> ?R'19453 length___unsigned_long cap cRootCap vRootCap rv rva rv' err (dc_ret_' s) (errstate s)))}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 9. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (tl args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>b. tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b))) b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rv \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R16762 length___unsigned_long cap cRootCap vRootCap False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps)))) \<lbrace>\<lambda>a b. isCNodeCap a \<longrightarrow> invs' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> (obj_at' tcbQueued thread b \<longrightarrow> st_tcb_at' runnable' thread b) \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' a b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rv \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and ?R16762 length___unsigned_long cap cRootCap vRootCap rv rva a\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 8. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rv \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rv \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rva (hd (tl (tl args))) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; Suc (Suc (Suc 0)) \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16755 length___unsigned_long cap cRootCap vRootCap False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') \<lbrace>deriveCap_ret_C.status_C \<acute>dc_ret = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<acute>dc_ret) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvb. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'16755 length___unsigned_long cap cRootCap vRootCap rv rva rvb (cRootCap_' s)}
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 7. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rv. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<lbrace>?R16542 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> return () \<lbrace>\<lambda>a b. invs' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> st_tcb_at' runnable' thread b \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rv. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>}
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and ?R16542 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned a) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 6. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap rv rva\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rv. ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (hd (tl args)) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>}
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; Suc (Suc (Suc 0)) \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; \<not> rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F16534 length___unsigned_long cap cRootCap vRootCap False False\<^esub> (?R'16536 length___unsigned_long cap cRootCap vRootCap False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false)) Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'16536 length___unsigned_long cap cRootCap vRootCap rv ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 5. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> {sa. (sa \<in> (if args ! Suc 0 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' s)) (args ! Suc 0) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rv (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' sa \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (sa \<notin> (if args ! Suc 0 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rv (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' sa \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R15383 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a b. (\<not> a \<longrightarrow> invs' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> st_tcb_at' runnable' thread b \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) b\<rbrace>
 2. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> {sa. (sa \<in> (if args ! Suc 0 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' s)) (args ! Suc 0) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rv (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' sa \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (sa \<notin> (if args ! Suc 0 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rv (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' sa \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and ?R15383 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned a and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 4. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rv \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> {sa. (sa \<in> (if args ! Suc 0 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' s)) (args ! Suc 0) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rv (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' sa \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (sa \<notin> (if args ! Suc 0 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rv (args ! Suc 0) (fst (hd extraCaps))) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' sa \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rvd else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) rvd) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> tcb_at' (ret__unsigned && 0xFFFFFE00) a) and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length___unsigned_long cap cRootCap vRootCap rv ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; \<not> rv; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'15376 length___unsigned_long cap (args ! 0) (args ! Suc 0) (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) \<lbrace>\<forall>rv. from_bool rv = \<acute>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool \<acute>ret__unsigned_long) (args ! Suc 0) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rvd else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) rvd) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> tcb_at' (ret__unsigned && 0xFFFFFE00) a) and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 3. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rv \<longrightarrow> sa \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'15376 length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned rv (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>b. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rvd else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) rvd) a \<and> cte_wp_at' (\<lambda>_. True) slot a) \<and> tcb_at' (ret__unsigned && 0xFFFFFE00) a) and tcb_at' (ret__unsigned && 0xFFFFFE00)) b)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)\<rbrace>
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> \<lbrace>\<forall>t rva. from_bool rva = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData capa) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) rvd) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rvd \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) rvd) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rvd \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14405 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a b. (\<not> a \<longrightarrow> invs' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> sch_act_wf (ksSchedulerAction b) b \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread b \<and> thread \<noteq> ksIdleThread b \<and> st_tcb_at' runnable' thread b \<and> sch_act_simple b \<and> invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) b \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) b \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) b) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) b\<rbrace>
 2. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> \<lbrace>\<forall>t rva. from_bool rva = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData capa) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) rvd) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rvd \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) rvd) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rvd \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and ?R14405 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 10. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rv \<longrightarrow> s \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> rv \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rv \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> \<lbrace>\<forall>t rva. from_bool rva = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData capa) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) rvd) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rvd \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) capa) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rv (args ! Suc (Suc 0)) rvd) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rvd \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rvd else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) rvd) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap rvd vRootCap ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; Suc (Suc (Suc 0)) \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! Suc (Suc 0); ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rvd = fst (extraCaps ! Suc 0); ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14398 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! Suc (Suc 0)) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rv. from_bool rv = ret__unsigned_long_' s \<longrightarrow> (rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' s \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = cRootCap_' s \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = vRootCap_' s \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' s) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' s) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = vRootCap_' s \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' s) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries}
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rvd else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) rvd) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (vRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'14398 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap rvd (vRootCap_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 9. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 1) \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rvd else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) rvd) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00)) s\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> {sa. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0))\<rbrace> getSlotCap (snd (extraCaps ! Suc 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! Suc 0) \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (hd (drop (Suc 0) args)) (fst (hd extraCaps))) s \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (hd (drop (Suc (Suc 0)) args)) (fst (extraCaps ! Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> {sa. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R13546 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! 2) (fst (extraCaps ! 0))\<rbrace> getSlotCap (snd (extraCaps ! Suc 0)) \<lbrace>\<lambda>r s. r = fst (extraCaps ! Suc 0) \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> {sa. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R13546 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 8. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 10. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2; ccap_relation rvc cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> {sa. \<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> (\<exists>s. (s, sa\<lparr>ret__unsigned_long_' := ret__unsigned_long_' t\<rparr>) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap_' s = vRootCap_' sa \<and> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData rv) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> ccap_relation rv (vRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}}
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData rvc cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; Suc (Suc (Suc 0)) \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! Suc (Suc 0); ccap_relation (fst (extraCaps ! 0)) cRootCap; rvc = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13543 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! Suc (Suc 0)) (fst (extraCaps ! 0)) cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' s) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = cRootCap_' s \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' s) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (vRootCap_' s) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvc. ccap_relation rvc (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvc = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'13543 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData rvc (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 7. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 9. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps)) s\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> {sa. ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, vRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap_' s = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (cRootCap_' s) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap} \<inter> \<lbrace>True\<rbrace>}}}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R12286 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) ()\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvc s. rvc = fst (extraCaps ! 0) \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! Suc 0)) (snd (extraCaps ! Suc 0)) s \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) s) \<and> excaps_in_mem extraCaps (ctes_of s)\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> {sa. ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, vRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap_' s = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (cRootCap_' s) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap} \<inter> \<lbrace>True\<rbrace>}}}
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R12286 length___unsigned_long cap rv faultEP rva cRootData rvb and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 6. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 8. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 9. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1; vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb vRootData) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> {sa. ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, vRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap_' s = cRootCap_' sa \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (cRootCap_' s) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' sa) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False vRootData capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False vRootData (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap} \<inter> \<lbrace>True\<rbrace>}}}
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; Suc (Suc (Suc 0)) \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! Suc (Suc 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12283 length___unsigned_long cap () (args ! 0) () (args ! Suc 0) () (args ! Suc (Suc 0))) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. ccap_relation (fst (extraCaps ! 0)) (cRootCap_' s) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (cRootCap_' s) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' s) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)}
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'12283 length___unsigned_long cap rv faultEP rva cRootData rvb (vRootData_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 5. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 7. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) a \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) a) \<and> excaps_in_mem extraCaps (ctes_of a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rv. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, cRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData_' s \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (vRootData_' s) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (vRootData_' s) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData_' s = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData_' s \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (vRootData_' s) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (vRootData_' s) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData_' s = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)} \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 5. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long cap faultEP cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0\<rbrakk> \<Longrightarrow> \<lbrace>?R10563 length___unsigned_long cap () (args ! 0) ()\<rbrace> return () \<lbrace>\<lambda>rvb. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) s \<and> excaps_in_mem extraCaps (ctes_of s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) s) and excaps_in_mem extraCaps \<circ> ctes_of\<rbrace>
 2. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rv. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, cRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData_' s \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (vRootData_' s) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (vRootData_' s) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData_' s = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData_' s \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (vRootData_' s) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (vRootData_' s) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData_' s = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)} \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R10563 length___unsigned_long cap rv faultEP rva\<rbrace>
 4. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 5. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 6. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 7. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long cap rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0; cRootData = args ! 1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10561 length___unsigned_long cap rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rv. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> {sa. ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, cRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) cRootData capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData_' s \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (vRootData_' s) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (vRootData_' s) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData_' s = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (vRootData_' s \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (vRootData_' s) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (vRootData_' s) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (vRootData_' s = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)} \<inter> \<lbrace>True\<rbrace>}}
 2. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R9666 length___unsigned_long cap rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) s \<and> excaps_in_mem extraCaps (ctes_of s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) s) and excaps_in_mem extraCaps \<circ> ctes_of)\<rbrace>
 3. \<And>length___unsigned_long cap rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9664 length___unsigned_long cap rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = args ! 1 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'10561 length___unsigned_long cap rv faultEP rva (cRootData_' s)}
 4. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R8709 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R9666 length___unsigned_long cap a\<rbrace>
 5. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 3 \<le> length args; extraCaps \<noteq> []; Suc 0 < length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'8704 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'9664 length___unsigned_long cap rv (faultEP_' s)}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_active' and sch_act_simple and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) and excaps_in_mem extraCaps \<circ> ctes_of and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> (((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> True) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R8709 buffera current_extra_caps slota length___unsigned_long cap) s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 3 then 1 else 0\<rparr> \<in> {s. ((if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length___unsigned_long < 3 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>(\<acute>ret__int \<noteq> 0 \<longrightarrow> True) \<and> (\<not> \<acute>ret__int \<noteq> 0 \<longrightarrow> False)\<rbrace>) \<and> (\<not> (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. (length (interpret_excaps current_extra_caps) = Suc 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (length (interpret_excaps current_extra_caps) \<noteq> Suc 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'8704 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (1 subgoal):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; invs' s \<and> ksCurThread s = thread \<and> ct_active' s \<and> sch_act_simple s \<and> valid_cap' cp s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> isThreadCap cp \<and> tcb_at' (capTCBPtr cp) s \<and> (\<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s) \<and> excaps_in_mem extraCaps (ctes_of s) \<and> (\<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) \<and> (\<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) \<and> sysargs_rel args buffer s; current_extra_caps_' (globals s') = extraCaps'\<rbrakk> \<Longrightarrow> (\<not> length___unsigned_long < 3 \<longrightarrow> excaprefs_C extraCaps'.[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer (Suc (Suc 0)) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0])) s)) \<and> (\<not> length___unsigned_long < 3 \<longrightarrow> excaprefs_C extraCaps'.[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr thread \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (\<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer (Suc (Suc 0)) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)) \<and> (\<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer (Suc (Suc 0)) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer (Suc (Suc 0)) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer (Suc (Suc 0)) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> sysargs_rel_n args buffer (Suc (Suc 0)) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; st_tcb_at' active' (ksCurThread s) s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem extraCaps (ctes_of s); \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length args < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL \<longrightarrow> length (excaps_map extraCaps) \<noteq> Suc 0 \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) a) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa) ! 0 \<and> (length (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa)] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) a) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa) ! 0 \<and> (length (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa)] = NULL); excaprefs_C (current_extra_caps_' (globals s')).[1] = (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa) ! 1 \<and> (length (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa)] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (\<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) a) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s) \<and> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap)) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; ysa = [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> 2 ^ cteSizeBits = 0x10 \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> \<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) capa) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) a) (ret__struct_cap_C_' ta) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>capa. ccap_relation capa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) capa) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> ((\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_thread_cap proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; ysa = [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> \<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> 2 ^ cteSizeBits = 0x10 \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> \<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) a) (ret__struct_cap_C_' ta) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args)))))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; ysa = [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))); args \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> (rv \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rv \<longrightarrow> 2 ^ cteSizeBits = 0x10 \<and> (\<forall>t rv. from_bool rv = ret__unsigned_long_' t \<longrightarrow> \<not> rv \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) a) (ret__struct_cap_C_' ta) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) aa) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> (\<exists>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_null_cap) \<longrightarrow> args ! 0 = hd args))))))))
 2. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; ysa = [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> args \<noteq> [] proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ysa. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # map (\<lambda>(cp, y). cte_Ptr y) ysa; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; thread = ksCurThread s; ct_active' s; sch_act_simple s; valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; tcb_at' (capTCBPtr cp) s; \<forall>rf\<in>zobj_refs' cp. ex_nonz_cap_to' rf s; excaps_in_mem ((a, b) # (aa, ba) # ysa) (ctes_of s); sysargs_rel args buffer s; \<not> length args < 3; extraCaps = (a, b) # (aa, ba) # ysa; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; \<forall>v\<in>set ysa. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; \<forall>v\<in>set ysa. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; ysa = [] \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = NULL; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> args \<noteq> [] proof (prove)
goal:
No subgoals!