theory KHeap_DR

lemma set_cap_corres:
assumes "cap = transform_cap cap'"  "slot = transform_cslot_ptr slot'"
shows "dcorres dc \<top>
           (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s)
           (KHeap_D.set_cap slot cap)
           (CSpaceAcc_A.set_cap cap' slot')" proof - note if_cong[cong] from assms show ?thesis apply (case_tac slot') apply (rename_tac p' sl') apply (case_tac slot) apply (rename_tac p sl) apply (clarsimp simp: KHeap_D.set_cap_def CSpaceAcc_A.set_cap_def) apply (drule sym) apply (clarsimp simp:get_object_def gets_the_def bind_assoc gets_def split:if_splits) apply (clarsimp simp: transform_cslot_ptr_def) apply (rule dcorres_get) apply (rename_tac s s') apply (clarsimp simp: assert_def corres_free_fail) apply (rename_tac obj') apply (case_tac obj', simp_all add:corres_free_fail split del: if_split)
   \<comment> \<open>cnode or IRQ Node case\<close> apply (clarsimp simp: corres_free_fail split: if_split) apply (rename_tac sz cn ocap) apply (clarsimp simp: corres_underlying_def in_monad set_object_def get_object_def
                         cte_wp_at_cases caps_of_state_cte_wp_at) apply (case_tac sz, simp) apply (frule (1) cdl_objects_irq_node) apply (clarsimp simp: assert_opt_def has_slots_def) apply (clarsimp simp: update_slots_def object_slots_def transform_cnode_contents_upd) apply (clarsimp simp: KHeap_D.set_object_def simpler_modify_def) apply (clarsimp simp: transform_def transform_current_thread_def) apply (clarsimp simp: transform_objects_def) apply (rule ext) apply clarsimp apply (simp add: option_map_def restrict_map_def map_add_def split: option.splits) apply (frule (1) cdl_objects_cnode, simp) apply (clarsimp simp: assert_opt_def has_slots_def) apply (clarsimp simp: update_slots_def object_slots_def transform_cnode_contents_upd) apply (clarsimp simp: KHeap_D.set_object_def simpler_modify_def) apply (clarsimp simp: transform_def transform_current_thread_def) apply (clarsimp simp: transform_objects_def) apply (rule ext) apply clarsimp apply (simp add: option_map_def restrict_map_def map_add_def split: option.splits)
  \<comment> \<open>tcb case\<close> apply (drule(1) valid_etcbs_tcb_etcb) apply (clarsimp simp: cdl_objects_tcb assert_opt_def has_slots_def object_slots_def
                        update_slots_def
                  split del: if_split) apply (case_tac "nat (bl_to_bin sl') = tcb_ipcbuffer_slot") apply (simp add: tcb_slots) apply (clarsimp simp: bl_to_bin_tcb_cnode_index|rule conjI)+ apply (rule corres_guard_imp) apply (rule select_pick_corres) apply (rule_tac s'=s' in dcorres_set_object_tcb) apply (clarsimp simp: transform_tcb_def) apply (rule conjI) apply (rule ext) apply (clarsimp simp: transform_tcb_def tcb_slots) apply (rule refl) apply assumption apply simp apply simp apply simp apply clarsimp apply (rule impI) apply (rule dcorres_set_object_tcb) apply (clarsimp simp: transform_tcb_def) apply (rule conjI) apply (rule ext) apply (clarsimp simp: transform_tcb_def tcb_slots) apply (erule transform_full_intent_same_cap) apply simp apply simp apply ((clarsimp simp: bl_to_bin_tcb_cnode_index corres_free_fail|rule conjI)+)[2]  (* sseefried: brittle. Try changing number on end *)
   apply (simp add: bl_to_bin_tcb_cnode_index tcb_slot_defs) apply (rule conjI) apply (clarsimp simp: bl_to_bin_tcb_cnode_index) by (rule conjI ext dcorres_set_object_tcb|simp|
         clarsimp simp: transform_tcb_def tcb_slot_defs corres_free_fail
                  cong: transform_full_intent_caps_cong_weak)+ qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (state)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (chain)
picking this:
cap = transform_cap cap'
slot = transform_cslot_ptr slot' proof (prove)
using this:
cap = transform_cap cap'
slot = transform_cslot_ptr slot'

goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>cap = transform_cap cap'; slot = transform_cslot_ptr slot'; slot' = (a, b)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl'. \<lbrakk>cap = transform_cap cap'; slot = transform_cslot_ptr slot'; slot' = (p', sl')\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' a b. \<lbrakk>cap = transform_cap cap'; slot = transform_cslot_ptr slot'; slot' = (p', sl'); slot = (a, b)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' p sl. \<lbrakk>cap = transform_cap cap'; slot = transform_cslot_ptr slot'; slot' = (p', sl'); slot = (p, sl)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' p sl. \<lbrakk>cap = transform_cap cap'; (p, sl) = transform_cslot_ptr (p', sl'); slot' = (p', sl'); slot = transform_cslot_ptr (p', sl')\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> p' \<noteq> idle_thread s \<and> valid_etcbs s) ((case transform_cslot_ptr (p', sl') of (obj_id, slot) \<Rightarrow> \<lambda>cap. do obj <- KHeap_D.get_object obj_id;
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(slot \<mapsto> cap)) obj of Tcb t \<Rightarrow> if slot = tcb_ipcbuffer_slot \<and> object_slots obj slot \<noteq> Some cap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(slot \<mapsto> cap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(slot \<mapsto> cap)) obj)) >>= KHeap_D.set_object obj_id
od) (transform_cap cap')) (do obj <- KHeap_A.get_object p';
(case obj of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p'
od) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' p sl. \<lbrakk>(p, sl) = transform_cslot_ptr (p', sl'); slot' = (p', sl'); slot = transform_cslot_ptr (p', sl'); transform_cap cap' = cap\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> p' \<noteq> idle_thread s \<and> valid_etcbs s) ((case transform_cslot_ptr (p', sl') of (obj_id, slot) \<Rightarrow> \<lambda>cap. do obj <- KHeap_D.get_object obj_id;
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(slot \<mapsto> cap)) obj of Tcb t \<Rightarrow> if slot = tcb_ipcbuffer_slot \<and> object_slots obj slot \<noteq> Some cap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(slot \<mapsto> cap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(slot \<mapsto> cap)) obj)) >>= KHeap_D.set_object obj_id
od) (transform_cap cap')) (do obj <- KHeap_A.get_object p';
(case obj of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p'
od) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' p sl. \<lbrakk>(p, sl) = transform_cslot_ptr (p', sl'); slot' = (p', sl'); slot = transform_cslot_ptr (p', sl'); cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> p' \<noteq> idle_thread s \<and> valid_etcbs s) ((case transform_cslot_ptr (p', sl') of (obj_id, slot) \<Rightarrow> \<lambda>cap. do x <- get;
obj <- assert_opt (cdl_objects x obj_id);
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(slot \<mapsto> cap)) obj of Tcb t \<Rightarrow> if slot = tcb_ipcbuffer_slot \<and> object_slots obj slot \<noteq> Some cap then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(slot \<mapsto> cap)) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(slot \<mapsto> cap)) obj)) >>= KHeap_D.set_object obj_id
od) (transform_cap cap')) (do x <- get;
y <- assert (\<exists>y. kheap x p' = Some y);
(case the (kheap x p') of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p'
od) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl'. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> p' \<noteq> idle_thread s \<and> valid_etcbs s) (do x <- get;
obj <- assert_opt (cdl_objects x p');
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (do x <- get;
y <- assert (\<exists>y. kheap x p' = Some y);
(case the (kheap x p') of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p'
od) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' x xa. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; x = transform xa; True; valid_idle xa \<and> p' \<noteq> idle_thread xa \<and> valid_etcbs xa\<rbrakk> \<Longrightarrow> dcorres dc ((=) x) ((=) xa) (do obj <- assert_opt (cdl_objects x p');
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (do y <- assert (\<exists>y. kheap xa p' = Some y);
(case the (kheap xa p') of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p'
od) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s s'. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; s = transform s'; True; valid_idle s' \<and> p' \<noteq> idle_thread s' \<and> valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do obj <- assert_opt (cdl_objects s p');
y <- assert (has_slots obj);
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (do y <- assert (\<exists>y. kheap s' p' = Some y);
(case the (kheap s' p') of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p'
od) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' y. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some y\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((case y of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' obj'. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some obj'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((case obj' of kernel_object.CNode sz cn \<Rightarrow> if sl' \<in> dom cn \<and> well_formed_cnode_n sz cn then return $ kernel_object.CNode sz $ cn(sl' \<mapsto> cap') else fail | TCB tcb \<Rightarrow> if sl' = tcb_cnode_index 0 then return $ TCB $ tcb\<lparr>tcb_ctable := cap'\<rparr> else if sl' = tcb_cnode_index 1 then return $ TCB $ tcb\<lparr>tcb_vtable := cap'\<rparr> else if sl' = tcb_cnode_index 2 then return $ TCB $ tcb\<lparr>tcb_reply := cap'\<rparr> else if sl' = tcb_cnode_index 3 then return $ TCB $ tcb\<lparr>tcb_caller := cap'\<rparr> else if sl' = tcb_cnode_index 4 then return $ TCB $ tcb\<lparr>tcb_ipcframe := cap'\<rparr> else fail | _ \<Rightarrow> fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' obj' x11 x12. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode x11 x12); obj' = kernel_object.CNode x11 x12\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' \<in> dom x12 \<and> well_formed_cnode_n x11 x12 then return (kernel_object.CNode x11 (x12(sl' \<mapsto> cap'))) else fail) >>= KHeap_A.set_object p')
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' x11 x12 y. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode x11 x12); well_formed_cnode_n x11 x12; x12 sl' = Some y\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (KHeap_A.set_object p' (kernel_object.CNode x11 (x12(sl' \<mapsto> cap'))))
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' sz cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (KHeap_A.set_object p' (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))))
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' sz cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap')))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' sz cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); sz = 0\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' sz cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); sz = 0; cdl_objects (transform s') p' = Some (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); cdl_objects (transform s') p' = Some (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (((case update_slots ((object_slots (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>))(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>) of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>) (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>))(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>)) | _ \<Rightarrow> return (update_slots ((object_slots (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>))(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>))) >>= KHeap_D.set_object p') (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); cdl_objects (transform s') p' = Some (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (KHeap_D.set_object p' (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 (cn(sl' \<mapsto> cap'))\<rparr>) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); cdl_objects (transform s') p' = Some (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>)\<rbrakk> \<Longrightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))) s') = dupdate_cdl_object p' (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 (cn(sl' \<mapsto> cap'))\<rparr>) (transform s')
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); transform_objects s' p' = Some (IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 cn\<rparr>)\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))) s') = (transform_objects s')(p' \<mapsto> IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 (cn(sl' \<mapsto> cap'))\<rparr>)
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))\<rbrakk> \<Longrightarrow> (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) (if ptr = p' then Some (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))) else (kheap s' |` (- {idle_thread s'} - {p'})) ptr)) = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr)))(p' \<mapsto> IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 (cn(sl' \<mapsto> cap'))\<rparr>)
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap x. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap')))\<rbrakk> \<Longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) (if ptr = p' then Some (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))) else (kheap s' |` (- {idle_thread s'} - {p'})) ptr))) x = (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr)))(p' \<mapsto> IRQNode \<lparr>cdl_irq_node_caps = transform_cnode_contents 0 (cn(sl' \<mapsto> cap'))\<rparr>)) x
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' sl' s' cn ocap x. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode 0 cn); well_formed_cnode_n 0 cn; cn sl' = Some ocap; a_type (kernel_object.CNode 0 cn) = a_type (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))); x \<noteq> p'\<rbrakk> \<Longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) (if ptr = p' then Some (kernel_object.CNode 0 (cn(sl' \<mapsto> cap'))) else (kheap s' |` (- {idle_thread s'} - {p'})) ptr))) x = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr))) x
 2. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 3. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' sz cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode sz cn); well_formed_cnode_n sz cn; cn sl' = Some ocap; a_type (kernel_object.CNode sz cn) = a_type (kernel_object.CNode sz (cn(sl' \<mapsto> cap'))); sz = Suc nata; cdl_objects (transform s') p' = Some (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents sz cn, cdl_cnode_size_bits = sz\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode sz (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))); cdl_objects (transform s') p' = Some (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (((case update_slots ((object_slots (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>))(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>) of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>) (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>))(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>)) | _ \<Rightarrow> return (update_slots ((object_slots (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>))(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>))) >>= KHeap_D.set_object p') (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))); cdl_objects (transform s') p' = Some (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (KHeap_D.set_object p' (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) (cn(sl' \<mapsto> cap')), cdl_cnode_size_bits = Suc nata\<rparr>) (transform s')). case x of (r, x) \<Rightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap')))) s') = x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))); cdl_objects (transform s') p' = Some (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>)\<rbrakk> \<Longrightarrow> transform (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap')))) s') = dupdate_cdl_object p' (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) (cn(sl' \<mapsto> cap')), cdl_cnode_size_bits = Suc nata\<rparr>) (transform s')
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))); transform_objects s' p' = Some (cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) cn, cdl_cnode_size_bits = Suc nata\<rparr>)\<rbrakk> \<Longrightarrow> transform_objects (update_kheap ((kheap s')(p' \<mapsto> kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap')))) s') = (transform_objects s')(p' \<mapsto> cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) (cn(sl' \<mapsto> cap')), cdl_cnode_size_bits = Suc nata\<rparr>)
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap')))\<rbrakk> \<Longrightarrow> (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) (if ptr = p' then Some (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))) else (kheap s' |` (- {idle_thread s'} - {p'})) ptr)) = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr)))(p' \<mapsto> cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) (cn(sl' \<mapsto> cap')), cdl_cnode_size_bits = Suc nata\<rparr>)
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata x. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap')))\<rbrakk> \<Longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) (if ptr = p' then Some (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))) else (kheap s' |` (- {idle_thread s'} - {p'})) ptr))) x = (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr)))(p' \<mapsto> cdl_object.CNode \<lparr>cdl_cnode_caps = transform_cnode_contents (Suc nata) (cn(sl' \<mapsto> cap')), cdl_cnode_size_bits = Suc nata\<rparr>)) x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' cn ocap nata x. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (kernel_object.CNode (Suc nata) cn); well_formed_cnode_n (Suc nata) cn; cn sl' = Some ocap; a_type (kernel_object.CNode (Suc nata) cn) = a_type (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))); x \<noteq> p'\<rbrakk> \<Longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) (if ptr = p' then Some (kernel_object.CNode (Suc nata) (cn(sl' \<mapsto> cap'))) else (kheap s' |` (- {idle_thread s'} - {p'})) ptr))) x = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s'}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s') ptr ((ekheap s' |` (- {idle_thread s'})) ptr)) ((kheap s' |` (- {idle_thread s'})) ptr))) x
 2. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; valid_etcbs s'; kheap s' p' = Some (TCB x2); obj' = TCB x2\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' obj' x2. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); obj' = TCB x2; \<exists>etcb. ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do obj <- assert_opt (cdl_objects (transform s') p');
y <- if has_slots obj then return () else fail;
(case update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj of Tcb t \<Rightarrow> if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> object_slots obj (nat (bl_to_bin sl')) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return $ Tcb (dupdate_tcb_intent intent' t)
od else return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj) | _ \<Rightarrow> return (update_slots ((object_slots obj)(nat (bl_to_bin sl') \<mapsto> transform_cap cap')) obj)) >>= KHeap_D.set_object p'
od) ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p')
 2. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> (sl' = tcb_cnode_index 4 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail))))))
 2. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (4 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 3. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 4. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (6 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?Q131 p' s' x2 etcb) (?Q'131 p' s' x2 etcb) (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 2. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ?Q131 p' s' x2 etcb s
 3. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> ?Q'131 p' s' x2 etcb s
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (6 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?P135 p' s' x2 etcb) (?Q'131 p' s' x2 etcb) (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = ?x135 p' s' x2 etcb, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 2. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> (?P135 p' s' x2 etcb and (\<lambda>s. ?x135 p' s' x2 etcb \<in> UNIV)) s
 3. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> ?Q'131 p' s' x2 etcb s
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (9 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> \<exists>etcb'. transform_tcb (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) etcb' = Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = ?x135 p' s' x2 etcb, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> \<and> ekheap s' p' = Some etcb'
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. ?x135 p' s' x2 etcb \<in> UNIV)) s
 6. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 7. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 8. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 9. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (9 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap', tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2)] = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'] \<and> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = ?x135 p' s' x2 etcb
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. ?x135 p' s' x2 etcb \<in> UNIV)) s
 6. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 7. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 8. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 9. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (10 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap', tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2)] = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap']
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = ?x135 p' s' x2 etcb
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 6. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. ?x135 p' s' x2 etcb \<in> UNIV)) s
 7. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 8. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 9. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 10. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (10 subgoals):
 1. \<And>p' s' x2 etcb x. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap', tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2)] x = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'] x
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = ?x135 p' s' x2 etcb
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 6. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. ?x135 p' s' x2 etcb \<in> UNIV)) s
 7. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 8. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 9. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 10. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (9 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = ?x135 p' s' x2 etcb
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. ?x135 p' s' x2 etcb \<in> UNIV)) s
 6. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 7. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 8. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 9. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (8 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) \<in> UNIV)) s
 5. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 6. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 7. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 8. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (7 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 3. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) \<in> UNIV)) s
 4. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 5. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 7. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (6 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 2. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) \<in> UNIV)) s
 3. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (5 subgoals):
 1. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; transform s' = s\<rbrakk> \<Longrightarrow> ((=) (transform s') and (\<lambda>s. transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) \<in> UNIV)) s
 2. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 4. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (4 subgoals):
 1. \<And>p' s' x2 etcb s. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap'; s' = s\<rbrakk> \<Longrightarrow> s' = s
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 3. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 4. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb\<rbrakk> \<Longrightarrow> transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 2. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 3. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 2. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 3. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (6 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> \<exists>etcb'. transform_tcb (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) etcb' = Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> \<and> ekheap s' p' = Some etcb'
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (6 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap', tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2)] = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'] \<and> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = transform_full_intent (machine_state s') p' x2
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (7 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap', tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2)] = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap']
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = transform_full_intent (machine_state s') p' x2
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 7. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (7 subgoals):
 1. \<And>p' s' x2 etcb x. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap', tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2)] x = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'] x
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = transform_full_intent (machine_state s') p' x2
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 5. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 7. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (6 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s') p' (x2\<lparr>tcb_ipcframe := cap'\<rparr>) = transform_full_intent (machine_state s') p' x2
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 4. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 6. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (5 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> p' \<noteq> idle_thread s'
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 3. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 4. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 5. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (4 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> kheap s' p' \<noteq> None
 2. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 3. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 4. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (3 subgoals):
 1. \<And>p' s' x2 etcb. \<lbrakk>slot' = (p', tcb_cnode_index 4); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; transform_cap (tcb_ipcframe x2) = transform_cap cap'\<rbrakk> \<Longrightarrow> ekheap s' p' \<noteq> None
 2. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', 4); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') = 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>))))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (transform_cap (tcb_ipcframe x2) \<noteq> transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do intent' <- select UNIV;
KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od) fail))) \<and> (transform_cap (tcb_ipcframe x2) = transform_cap cap' \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))))
 3. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> tcb_ipcbuffer_slot\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') ((if nat (bl_to_bin sl') = tcb_ipcbuffer_slot \<and> (if nat (bl_to_bin sl') = tcb_boundntfn_slot then Some (infer_tcb_bound_notification (tcb_bound_notification x2)) else if nat (bl_to_bin sl') = tcb_pending_op_slot then Some (infer_tcb_pending_op p' (tcb_state x2)) else if nat (bl_to_bin sl') = tcb_ipcbuffer_slot then Some (transform_cap (tcb_ipcframe x2)) else if nat (bl_to_bin sl') = tcb_caller_slot then Some (transform_cap (tcb_caller x2)) else if nat (bl_to_bin sl') = tcb_replycap_slot then Some (transform_cap (tcb_reply x2)) else if nat (bl_to_bin sl') = tcb_vspace_slot then Some (transform_cap (tcb_vtable x2)) else if nat (bl_to_bin sl') = tcb_cspace_slot then Some (transform_cap (tcb_ctable x2)) else None) \<noteq> Some (transform_cap cap') then do intent' <- select UNIV;
return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), tcb_ipcbuffer_slot \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = intent', cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)
od else return (Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op p' (tcb_state x2), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) >>= KHeap_D.set_object p') ((if sl' = tcb_cnode_index 0 then return (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)) else if sl' = tcb_cnode_index (Suc 0) then return (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)) else if sl' = tcb_cnode_index 2 then return (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)) else if sl' = tcb_cnode_index 3 then return (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)) else if sl' = tcb_cnode_index 4 then return (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)) else fail) >>= KHeap_A.set_object p') proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> 4\<rbrakk> \<Longrightarrow> (sl' = tcb_cnode_index 4 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 3 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 2 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), Suc 0 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 0 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail))))) proof (prove)
goal (2 subgoals):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> 4\<rbrakk> \<Longrightarrow> sl' = tcb_cnode_index 4 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 4 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ipcframe := cap'\<rparr>)))
 2. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 3 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 2 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), Suc 0 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 0 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))) proof (prove)
goal (1 subgoal):
 1. \<And>p' sl' s' x2 etcb. \<lbrakk>slot' = (p', sl'); slot = (p', nat (bl_to_bin sl')); cap = transform_cap cap'; valid_idle s'; p' \<noteq> idle_thread s'; kheap s' p' = Some (TCB x2); ekheap s' p' = Some etcb; nat (bl_to_bin sl') \<noteq> 4\<rbrakk> \<Longrightarrow> sl' \<noteq> tcb_cnode_index 4 \<longrightarrow> (sl' = tcb_cnode_index 3 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 3 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_caller := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 3 \<longrightarrow> (sl' = tcb_cnode_index 2 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 2 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_reply := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 2 \<longrightarrow> (sl' = tcb_cnode_index (Suc 0) \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), Suc 0 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_vtable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index (Suc 0) \<longrightarrow> (sl' = tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), 0 \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) (KHeap_A.set_object p' (TCB (x2\<lparr>tcb_ctable := cap'\<rparr>)))) \<and> (sl' \<noteq> tcb_cnode_index 0 \<longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (KHeap_D.set_object p' (Tcb \<lparr>cdl_tcb_caps = [0 \<mapsto> transform_cap (tcb_ctable x2), Suc 0 \<mapsto> transform_cap (tcb_vtable x2), 2 \<mapsto> transform_cap (tcb_reply x2), 3 \<mapsto> transform_cap (tcb_caller x2), 4 \<mapsto> transform_cap (tcb_ipcframe x2), 5 \<mapsto> infer_tcb_pending_op p' (tcb_state x2), 6 \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2), nat (bl_to_bin sl') \<mapsto> transform_cap cap'], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2), cdl_tcb_intent = transform_full_intent (machine_state s') p' x2, cdl_tcb_has_fault = \<exists>y. tcb_fault x2 = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) fail)))) proof (state)
this:
dcorres dc (\<lambda>_. True) (\<lambda>s. valid_idle s \<and> fst slot' \<noteq> idle_thread s \<and> valid_etcbs s) (KHeap_D.set_cap slot cap) (CSpaceAcc_A.set_cap cap' slot')

goal:
No subgoals!