theory Ipc_DR

lemma corres_complete_ipc_transfer:
  "ep' = ep
  \<Longrightarrow> dcorres dc \<top>
           (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb
            and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node
            and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs)
           (Endpoint_D.do_ipc_transfer ep' send recv can_grant) \<comment> \<open>FIXME argument order\<close>
           (Ipc_A.do_ipc_transfer send ep badge can_grant recv)" apply (clarsimp simp: Endpoint_D.do_ipc_transfer_def Ipc_A.do_ipc_transfer_def) apply (rule dcorres_expand_pfx) apply (rule dcorres_symb_exec_r_evalMonad) apply wp apply (clarsimp simp:thread_get_def get_send_slots_def get_thread_def bind_assoc) apply (rule dcorres_gets_the) apply (clarsimp, frule(1) valid_etcbs_get_tcb_get_etcb) apply (clarsimp simp:opt_object_tcb not_idle_thread_def transform_tcb_def split del:if_split) apply (case_tac "tcb_fault obj'") apply (clarsimp split del:if_split) apply (rule dcorres_symb_exec_r_evalMonad,wp) apply (simp add:do_normal_transfer_def get_message_info_def select_f_get_register split del:if_split) apply (rule dcorres_absorb_gets_the) apply (simp add:alternative_bind bind_assoc split del:if_split) apply (rule corres_alternate1) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule corres_if, simp) apply (rule corres_split_catch) apply clarsimp apply (rule corres_guard_imp[OF dcorres_lookup_extra_caps]) apply (clarsimp simp:not_idle_thread_def)+ apply assumption apply (rule corres_trivial) apply (clarsimp simp:transform_cap_list_def) apply wp+ apply (rule corres_trivial) apply (clarsimp simp:transform_cap_list_def) apply (rule corres_split[OF dcorres_copy_mrs']) apply (simp add:get_message_info_def select_f_get_register bind_assoc transform_cap_list_def) apply (rule corres_split[OF transfer_caps_dcorres]) apply (rule corres_corrupt_tcb_intent_dupl) apply (rule corres_split[OF set_message_info_corres]) unfolding K_bind_def apply (rule corrupt_tcb_intent_as_user_corres) apply (wp evalMonad_lookup_ipc_buffer_wp' hoare_vcg_ball_lift copy_mrs_valid_irq_node
                        | simp add:not_idle_thread_def split_def)+ apply (wp hoare_vcg_ball_lift | clarsimp)+ apply (rule validE_validE_R) apply (rule hoare_vcg_conj_liftE1) apply (rule hoare_post_imp_R) apply (rule validE_validE_R) apply (rule hoare_vcg_conj_liftE1[OF lookup_extra_caps_srcs]) apply (rule hoare_post_imp_dc2_actual[OF lookup_extra_caps_inv[where P=valid_objs]]) apply clarsimp apply (drule(1) bspec) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (case_tac "a = cap.NullCap",simp+) apply (erule(1) caps_of_state_valid_cap) apply (simp add:lookup_extra_caps_def) apply (wp mapME_wp mapME_length) apply (simp add:validE_def) apply (rule hoare_drop_imp) apply wp apply fastforce apply wp apply (rule hoare_vcg_conj_lift) apply (rule hoare_strengthen_post[OF get_extra_cptrs_length]) apply (simp add:msg_max_length_def max_ipc_length_unfold msg_max_extra_caps_def) apply wp+ apply fastforce apply clarsimp apply (rule conjI) apply (drule lookup_ipc_buffer_tcb_at)+ apply (clarsimp dest!:get_tcb_SomeD simp:tcb_at_def not_idle_thread_def) apply (rule conjI) apply (simp add:data_to_message_info_valid)+ apply (simp add:msg_max_length_def max_ipc_length_unfold) apply (clarsimp simp:not_idle_thread_def tcb_at_def max_ipc_length_unfold msg_max_length_def)+ apply (drule lookup_ipc_buffer_tcb_at)+ apply ((clarsimp simp:tcb_at_def empty_when_fail_lookup_ipc_buffer weak_det_spec_lookup_ipc_buffer)+)[3] apply (clarsimp simp:alternative_bind bind_assoc do_fault_transfer_def split del: if_split) apply (rule corres_alternate2) apply (rule corres_guard_imp) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (rule corres_symb_exec_r) apply (clarsimp) apply (rule corres_split[OF dcorres_set_mrs']) apply (rule corres_corrupt_tcb_intent_dupl) apply (rule corres_split[OF set_message_info_corres]) unfolding K_bind_def apply (rule corrupt_tcb_intent_as_user_corres) apply (wp|clarsimp simp:not_idle_thread_def)+ apply wpsimp+ apply (rule hoare_allI[OF hoare_drop_imp]) apply (wp|clarsimp)+ apply (rule conjI,simp) apply (clarsimp simp:lookup_ipc_buffer_tcb_at not_idle_thread_def opt_object_tcb
      empty_when_fail_lookup_ipc_buffer weak_det_spec_lookup_ipc_buffer | frule(1) valid_etcbs_get_tcb_get_etcb)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ep' = ep \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) (Endpoint_D.do_ipc_transfer ep' send recv can_grant) (Ipc_A.do_ipc_transfer send ep badge can_grant recv) proof (prove)
goal (1 subgoal):
 1. ep' = ep \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) (do src_slots <- get_send_slots send;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send src_slots <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do recv_buffer <- lookup_ipc_buffer True recv;
fault <- thread_get tcb_fault send;
case fault of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv recv_buffer
od | Some f \<Rightarrow> do_fault_transfer badge send recv recv_buffer
od) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do src_slots <- get_send_slots send;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send src_slots <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do recv_buffer <- lookup_ipc_buffer True recv;
fault <- thread_get tcb_fault send;
case fault of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv recv_buffer
od | Some f \<Rightarrow> do_fault_transfer badge send recv recv_buffer
od) proof (prove)
goal (4 subgoals):
 1. \<And>s s' sa. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> \<lbrace>(=) sa\<rbrace> lookup_ipc_buffer True recv \<lbrace>\<lambda>r. (=) sa\<rbrace>
 2. \<And>s s' rv. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'; evalMonad (lookup_ipc_buffer True recv) s' = Some rv\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do src_slots <- get_send_slots send;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send src_slots <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do fault <- thread_get tcb_fault send;
case fault of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv
od)
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (3 subgoals):
 1. \<And>s s' rv. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'; evalMonad (lookup_ipc_buffer True recv) s' = Some rv\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do src_slots <- get_send_slots send;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send src_slots <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do fault <- thread_get tcb_fault send;
case fault of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv
od)
 2. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (3 subgoals):
 1. \<And>s' rv. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- KHeap_D.get_object send;
tcb <- case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent tcb)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do tcb <- gets_the (get_tcb send);
case tcb_fault tcb of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv
od)
 2. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>s' rv s s'a obj obj'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a = Some obj'; cdl_objects s send = Some obj\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s'a) (do tcb <- case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent tcb)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv s'a obj obj'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; not_idle_thread (cur_thread s'a) s'a; valid_irq_node s'a; valid_idle s'a; not_idle_thread recv s'a; not_idle_thread send s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; cdl_objects (transform s'a) send = Some obj; \<exists>etcb. get_etcb send s'a = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do tcb <- case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail;
y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent tcb)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (5 subgoals):
 1. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 2. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 3. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 5. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (5 subgoals):
 1. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od)
 2. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 3. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 5. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv s'a obj' etcb rva. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s'a = Some rva\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do_normal_transfer send rva ep badge can_grant recv rv)
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv s'a obj' etcb rva. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s'a = Some rva\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do tcb <- gets_the (get_tcb send);
caps <- if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch tcb) msg_info_register)) <catch> K (return []) else return [];
mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch tcb) msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch tcb) msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch tcb) msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s'a = Some rva; s'a = s'; get_tcb send s' = Some obj'a; transform s'a = transform s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do caps <- if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [];
mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od \<sqinter> do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do caps <- if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [];
mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do caps <- if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [];
mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (9 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres dc (?Q55 rv s'a obj' etcb rva s' obj'a) (?Q'55 rv s'a obj' etcb rva s' obj'a) (do x <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do caps <- if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [];
mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ?Q55 rv s'a obj' etcb rva s' obj'a s
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ?Q'55 rv s'a obj' etcb rva s' obj'a s
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 7. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (12 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?P59 rv s'a obj' etcb rva s' obj'a) (?P'59 rv s'a obj' etcb rva s' obj'a) (if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return []) (if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [])
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; ?r'59 rv s'a obj' etcb rva s' obj'a x caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> (?P59 rv s'a obj' etcb rva s' obj'a and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> (?P'59 rv s'a obj' etcb rva s' obj'a and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?P64 rv s'a obj' etcb rva s' obj'a) (?P'64 rv s'a obj' etcb rva s' obj'a) (Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return [])) (Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []))
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; ?r'59 rv s'a obj' etcb rva s' obj'a x caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P64 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 7. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P'64 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?f68 rv s'a obj' etcb rva s' obj'a \<oplus> ?r'59 rv s'a obj' etcb rva s' obj'a) (?P68 rv s'a obj' etcb rva s' obj'a) (?P'68 rv s'a obj' etcb rva s' obj'a) (Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>))) (Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)))
 2. \<And>rv s'a obj' etcb rva s' obj'a uu_ ft'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; ?f68 rv s'a obj' etcb rva s' obj'a uu_ ft'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?E68 rv s'a obj' etcb rva s' obj'a uu_) (?E'68 rv s'a obj' etcb rva s' obj'a ft') (return []) (K (return []) ft')
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 rv s'a obj' etcb rva s' obj'a\<rbrace> Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 rv s'a obj' etcb rva s' obj'a\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 6. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; ?r'59 rv s'a obj' etcb rva s' obj'a x caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P68 rv s'a obj' etcb rva s' obj'a and ?Q68 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P'68 rv s'a obj' etcb rva s' obj'a and ?Q'68 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?f68 rv s' obj' etcb rva s' obj' \<oplus> ?r'59 rv s' obj' etcb rva s' obj') (?P68 rv s' obj' etcb rva s' obj') (?P'68 rv s' obj' etcb rva s' obj') (Endpoint_D.lookup_extra_caps send (cdl_intent_extras (transform_full_intent (machine_state s') send obj'))) (Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)))
 2. \<And>rv s'a obj' etcb rva s' obj'a uu_ ft'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; ?f68 rv s'a obj' etcb rva s' obj'a uu_ ft'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?E68 rv s'a obj' etcb rva s' obj'a uu_) (?E'68 rv s'a obj' etcb rva s' obj'a ft') (return []) (K (return []) ft')
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 rv s'a obj' etcb rva s' obj'a\<rbrace> Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 rv s'a obj' etcb rva s' obj'a\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (?r'59 rv s'a obj' etcb rva s' obj'a) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 6. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; ?r'59 rv s'a obj' etcb rva s' obj'a x caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P68 rv s'a obj' etcb rva s' obj'a and ?Q68 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P'68 rv s'a obj' etcb rva s' obj'a and ?Q'68 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
A total of 16 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> evalMonad (lookup_ipc_buffer False send) s' = Some rva
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> get_tcb send s' = Some obj'
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> valid_global_refs s'
 4. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> valid_objs s'
 5. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> valid_irq_node s'
 6. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> valid_idle s'
 7. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> valid_etcbs s'
 8. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> not_idle_thread send s'
 9. \<And>rv obj' etcb rva s' s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; ?P79 rv obj' obj' etcb rva s' s' s\<rbrakk> \<Longrightarrow> True
 10. \<And>rv obj' etcb rva s' s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; ?P'80 rv obj' obj' etcb rva s' s' s\<rbrakk> \<Longrightarrow> s' = s
A total of 25 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv obj' etcb rva s' s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; ?P'80 rv obj' obj' etcb rva s' s' s\<rbrakk> \<Longrightarrow> s' = s
 2. \<And>rv s'a obj' etcb rva s' obj'a uu_ ft'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; dc uu_ ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?E68 rv s'a obj' etcb rva s' obj'a uu_) (?E'68 rv s'a obj' etcb rva s' obj'a ft') (return []) (K (return []) ft')
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 rv s'a obj' etcb rva s' obj'a\<rbrace> Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 rv s'a obj' etcb rva s' obj'a\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 6. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and ?Q68 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P'80 rv obj' obj'a etcb rva s'a s' and ?Q'68 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a uu_ ft'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; dc uu_ ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?E68 rv s'a obj' etcb rva s' obj'a uu_) (?E'68 rv s'a obj' etcb rva s' obj'a ft') (return []) (K (return []) ft')
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 rv s'a obj' etcb rva s' obj'a\<rbrace> Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 rv s'a obj' etcb rva s' obj'a\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>?E'68 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 6. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and ?Q68 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and ?Q'68 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a uu_ ft'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; dc uu_ ft'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (\<lambda>_. True) (\<lambda>_. True) (return []) (K (return []) ft')
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 rv s'a obj' etcb rva s' obj'a\<rbrace> Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 rv s'a obj' etcb rva s' obj'a\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 6. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and ?Q68 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and ?Q'68 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 rv s'a obj' etcb rva s' obj'a\<rbrace> Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'68 rv s'a obj' etcb rva s' obj'a\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>ft' _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 4. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and ?Q68 rv s'a obj' etcb rva s' obj'a else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 8. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and ?Q'68 rv s'a obj' etcb rva s' obj'a else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 9. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 10. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (?Q64 rv s'a obj' etcb rva s' obj'a) (?Q'64 rv s'a obj' etcb rva s' obj'a) (return []) (return [])
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else ?Q64 rv s'a obj' etcb rva s' obj'a) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else ?Q'64 rv s'a obj' etcb rva s' obj'a) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. a = transform_cap_list b) (\<lambda>_. True) (\<lambda>_. True) (return []) (return [])
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> dcorres dc (?R59 rv s'a obj' etcb rva s' obj'a x) (?R'59 rv s'a obj' etcb rva s' obj'a caps) (do xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mrs_transferred <- copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)));
mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>?R59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>?R'59 rv s'a obj' etcb rva s' obj'a\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps xa mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps; dc xa mrs_transferred\<rbrakk> \<Longrightarrow> dcorres dc (?R107 rv s'a obj' etcb rva s' obj'a x caps xa) (?R'107 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred) (do y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od) (do mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>?R107 rv s'a obj' etcb rva s' obj'a x caps\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>?R'107 rv s'a obj' etcb rva s' obj'a x caps\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 7. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> dcorres dc (?R107 rv s' obj' etcb rva s' obj' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps ()) (?R'107 rv s' obj' etcb rva s' obj' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps mrs_transferred) (do y <- Endpoint_D.transfer_caps ep (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) send recv;
corrupt_tcb_intent recv
od) (do mi' <- Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv;
y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>?R107 rv s'a obj' etcb rva s' obj'a x caps\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>?R'107 rv s'a obj' etcb rva s' obj'a x caps\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 7. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> dcorres dc (?R120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y) (?R'120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi') (corrupt_tcb_intent recv) (do y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q127 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps ()\<rbrace> Endpoint_D.transfer_caps ep (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) send recv \<lbrace>?R120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps mrs_transferred\<rbrace> Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv \<lbrace>?R'120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q127 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>a. tcb_at recv and valid_idle and not_idle_thread recv and valid_global_refs and valid_irq_node and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set caps. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> 2 + msg_max_length + length caps < max_ipc_length) and valid_etcbs and ?Q'125 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> dcorres dc (?R120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y) (?R'120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi') (do corrupt_tcb_intent recv;
corrupt_tcb_intent recv
od) (do y <- set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))));
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q127 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps ()\<rbrace> Endpoint_D.transfer_caps ep (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) send recv \<lbrace>?R120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps mrs_transferred\<rbrace> Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv \<lbrace>?R'120 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q127 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>a. tcb_at recv and valid_idle and not_idle_thread recv and valid_global_refs and valid_irq_node and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set caps. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> 2 + msg_max_length + length caps < max_ipc_length) and valid_etcbs and ?Q'125 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi' rvb rv'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'; dc rvb rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi' rvb) (?R'134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi' rv') (K_bind (corrupt_tcb_intent recv) rvb) (as_user recv (setRegister badge_register badge))
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> \<lbrace>?Q136 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y\<rbrace> corrupt_tcb_intent recv \<lbrace>?R134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi'\<rbrace> set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)))) \<lbrace>?R'134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q127 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps ()\<rbrace> Endpoint_D.transfer_caps ep (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) send recv \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q136 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps mrs_transferred\<rbrace> Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv \<lbrace>\<lambda>mi'. valid_idle and not_idle_thread recv and valid_etcbs and ?Q'138 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi'\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q127 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>a. tcb_at recv and valid_idle and not_idle_thread recv and valid_global_refs and valid_irq_node and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set caps. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> 2 + msg_max_length + length caps < max_ipc_length) and valid_etcbs and ?Q'125 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 9. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 10. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi' rvb rv'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'; dc rvb rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi' rvb) (?R'134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi' rv') (corrupt_tcb_intent recv) (as_user recv (setRegister badge_register badge))
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> \<lbrace>?Q136 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y\<rbrace> corrupt_tcb_intent recv \<lbrace>?R134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi'\<rbrace> set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)))) \<lbrace>?R'134 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q127 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps ()\<rbrace> Endpoint_D.transfer_caps ep (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) send recv \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q136 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps mrs_transferred\<rbrace> Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv \<lbrace>\<lambda>mi'. valid_idle and not_idle_thread recv and valid_etcbs and ?Q'138 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi'\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q127 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>a. tcb_at recv and valid_idle and not_idle_thread recv and valid_global_refs and valid_irq_node and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set caps. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> 2 + msg_max_length + length caps < max_ipc_length) and valid_etcbs and ?Q'125 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 9. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 10. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> \<lbrace>?Q136 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y\<rbrace> corrupt_tcb_intent recv \<lbrace>\<lambda>rvb _. True\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y mi'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps; dc y mi'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi'\<rbrace> set_message_info recv (MI mrs_transferred (mi_extra_caps mi') (mi_caps_unwrapped mi') (mi_label (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)))) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread recv and valid_etcbs\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q127 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps ()\<rbrace> Endpoint_D.transfer_caps ep (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) send recv \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q136 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred y\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a x caps mrs_transferred. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 rv obj' obj' etcb rva s' s' (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps) caps mrs_transferred\<rbrace> Ipc_A.transfer_caps (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) caps ep recv rv \<lbrace>\<lambda>mi'. valid_idle and not_idle_thread recv and valid_etcbs and ?Q'138 rv s'a obj' etcb rva s' obj'a x caps mrs_transferred mi'\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q127 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 6. \<And>rv s'a obj' etcb rva s' obj'a x caps. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; x = transform_cap_list caps\<rbrakk> \<Longrightarrow> \<lbrace>?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace> copy_mrs send rva recv rv (mi_length (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>a. tcb_at recv and valid_idle and not_idle_thread recv and valid_global_refs and valid_irq_node and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set caps. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> 2 + msg_max_length + length caps < max_ipc_length) and valid_etcbs and ?Q'125 rv obj' obj'a etcb rva s'a s' x caps a\<rbrace>
 7. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [] \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q109 rv s'a obj' etcb rva s' obj'a x\<rbrace>
 8. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'59 rv s'a obj' etcb rva s' obj'a\<rbrace> if can_grant then Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) <catch> K (return []) else return [] \<lbrace>\<lambda>caps. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread113 rv s'a obj' etcb rva s' obj'a caps) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'116 rv s'a obj' etcb rva s' obj'a caps\<rbrace>
 9. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q59 rv s'a obj' etcb rva s' obj'a) s
 10. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and ?Q'59 rv s'a obj' etcb rva s' obj'a) s
A total of 16 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'559 rv s' obj' etcb rva s' obj'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. (\<forall>x\<in>set rv. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, -
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> ?P'559 rv s'a obj' etcb rva s' obj'a s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'559 rv s' obj' etcb rva s' obj'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. (\<forall>x\<in>set rv. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, -
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> ?P'559 rv s'a obj' etcb rva s' obj'a s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'569 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. (\<forall>x\<in>set rv. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> ?P'569 rv obj' obj'a etcb rva s'a s' s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P575 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. \<forall>x\<in>set rv. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s\<rbrace>, -
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (?P575 rv obj' obj'a etcb rva s'a s' and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (12 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P575 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>?Q'578 rv obj' etcb rva s'\<rbrace>, -
 2. \<And>rv obj' etcb rva s' rvb s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; ?Q'578 rv obj' etcb rva s' rvb s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (?P575 rv obj' obj'a etcb rva s'a s' and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (12 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P575 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>?Q'578 rv obj' etcb rva s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv obj' etcb rva s' rvb s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; ?Q'578 rv obj' etcb rva s' rvb s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (?P575 rv obj' obj'a etcb rva s'a s' and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (12 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'586 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>?Q'583 rv obj' etcb rva s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv obj' etcb rva s' rvb s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; (\<forall>x\<in>set rvb. cte_wp_at (\<lambda>cp. fst x \<noteq> cap.NullCap \<longrightarrow> cp = fst x) (snd x) s \<and> real_cte_at (snd x) s) \<and> ?Q'583 rv obj' etcb rva s' rvb s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and ?P'586 rv obj' obj'a etcb rva s'a s' and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' rvb s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; (\<forall>x\<in>set rvb. cte_wp_at (\<lambda>cp. fst x \<noteq> cap.NullCap \<longrightarrow> cp = fst x) (snd x) s \<and> real_cte_at (snd x) s) \<and> valid_objs s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' rvb s a aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; (a, aa, b) \<in> set rvb; \<forall>x\<in>set rvb. cte_wp_at (\<lambda>cp. fst x \<noteq> cap.NullCap \<longrightarrow> cp = fst x) (snd x) s \<and> real_cte_at (snd x) s; valid_objs s\<rbrakk> \<Longrightarrow> s \<turnstile> a \<and> cte_wp_at (\<lambda>b. a \<noteq> cap.NullCap \<longrightarrow> b \<noteq> a \<longrightarrow> b = masked_as_full a a) (aa, b) s
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' rvb s a aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; (a, aa, b) \<in> set rvb; valid_objs s; cte_wp_at (\<lambda>cp. fst (a, aa, b) \<noteq> cap.NullCap \<longrightarrow> cp = fst (a, aa, b)) (snd (a, aa, b)) s \<and> real_cte_at (snd (a, aa, b)) s\<rbrakk> \<Longrightarrow> s \<turnstile> a \<and> cte_wp_at (\<lambda>b. a \<noteq> cap.NullCap \<longrightarrow> b \<noteq> a \<longrightarrow> b = masked_as_full a a) (aa, b) s
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' rvb s a aa b cap. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; (a, aa, b) \<in> set rvb; valid_objs s; cap_table_at (length b) aa s; caps_of_state s (aa, b) = Some cap; a \<noteq> cap.NullCap \<longrightarrow> cap = a\<rbrakk> \<Longrightarrow> s \<turnstile> a
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' rvb s a aa b cap. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; (a, aa, b) \<in> set rvb; valid_objs s; cap_table_at (length b) aa s; caps_of_state s (aa, b) = Some a; cap = a; a \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> s \<turnstile> a
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> Ipc_A.lookup_extra_caps send rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'574 rv obj' obj' etcb rva s' s'\<rbrace> liftE (get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) >>=E mapME (\<lambda>cptr. cap_fault_on_failure (of_bl cptr) False (CSpace_A.lookup_cap_and_slot send cptr)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and ?P'574 rv obj' obj'a etcb rva s'a s') s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (12 subgoals):
 1. \<And>rv obj' etcb rva s' x xa. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; xa \<in> ?S614 rv obj' etcb rva s' x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a\<rbrace> CSpace_A.lookup_cap_and_slot send xa \<lbrace>\<lambda>rv a. valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a\<rbrace>, \<lbrace>\<lambda>ft _. True\<rbrace>
 2. \<And>rv obj' etcb rva s' x. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> set x \<subseteq> ?S614 rv obj' etcb rva s' x
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'607 rv obj' obj' etcb rva s' s'\<rbrace> liftE (get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>x s. Suc (Suc (msg_max_length + length x)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> ?P'607 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (12 subgoals):
 1. \<And>rv obj' etcb rva s' x xa. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; xa \<in> ?S614 rv obj' etcb rva s' x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a\<rbrace> CSpace_A.lookup_cap_and_slot send xa \<lbrace>\<lambda>v s. (\<exists>a aa b. v = Inr (a, aa, b)) \<longrightarrow> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>rv obj' etcb rva s' x. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> set x \<subseteq> ?S614 rv obj' etcb rva s' x
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'607 rv obj' obj' etcb rva s' s'\<rbrace> liftE (get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>x s. Suc (Suc (msg_max_length + length x)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> ?P'607 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (12 subgoals):
 1. \<And>rv obj' etcb rva s' x xa. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; xa \<in> ?S614 rv obj' etcb rva s' x\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a\<rbrace> CSpace_A.lookup_cap_and_slot send xa \<lbrace>\<lambda>rv s. valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>rv obj' etcb rva s' x. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> set x \<subseteq> ?S614 rv obj' etcb rva s' x
 3. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'607 rv obj' obj' etcb rva s' s'\<rbrace> liftE (get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>x s. Suc (Suc (msg_max_length + length x)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 6. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> ?P'607 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 9. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' x. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> set x \<subseteq> ?S614 rv obj' etcb rva s' x
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'607 rv obj' obj' etcb rva s' s'\<rbrace> liftE (get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>x s. Suc (Suc (msg_max_length + length x)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> ?P'607 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'607 rv obj' obj' etcb rva s' s'\<rbrace> liftE (get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<lbrace>\<lambda>x s. Suc (Suc (msg_max_length + length x)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> ?P'607 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'632 rv obj' obj' etcb rva s' s'\<rbrace> get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>x s. Suc (Suc (msg_max_length + length x)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> True \<and> ?P'632 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P640 rv obj' obj' etcb rva s' s'\<rbrace> get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. Suc (Suc (msg_max_length + length rv)) < max_ipc_length\<rbrace>
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 rv obj' obj' etcb rva s' s'\<rbrace> get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> True \<and> ?P640 rv obj' obj'a etcb rva s'a s' a \<and> ?P'639 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (11 subgoals):
 1. \<And>rv obj' etcb rva s' rvb s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant; length rvb \<le> msg_max_extra_caps\<rbrakk> \<Longrightarrow> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length
 2. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 rv obj' obj' etcb rva s' s'\<rbrace> get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 5. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> True \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<and> ?P'639 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (10 subgoals):
 1. \<And>rv obj' etcb rva s'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; get_tcb send s' = Some obj'; can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?P'639 rv obj' obj' etcb rva s' s'\<rbrace> get_extra_cptrs rva (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register)) \<lbrace>\<lambda>rv s. valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>rv s'a obj' etcb rva s' obj'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<lbrace>?R442 rv s'a obj' etcb rva s' obj'a\<rbrace> return [] \<lbrace>\<lambda>rvb s. valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set rvb. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length rvb)) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 3. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 4. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> True \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<and> ?P'639 rv obj' obj'a etcb rva s'a s' a)) s) \<and> (\<not> can_grant \<longrightarrow> ?R442 rv s'a obj' etcb rva s' obj'a s))) s
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 8. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (8 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; transform s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then ?P79 rv obj' obj'a etcb rva s'a s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. True \<and> True \<and> True \<and> True)) s
 2. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> True \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a)) s) \<and> (\<not> can_grant \<longrightarrow> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s))) s
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (7 subgoals):
 1. \<And>rv s'a obj' etcb rva s' obj'a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; cur_thread s' \<noteq> idle_thread s'; valid_irq_node s'; valid_idle s'; recv \<noteq> idle_thread s'; send \<noteq> idle_thread s'; valid_etcbs s'; obj'a = obj'; get_etcb send s' = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s' = Some rva; s'a = s'; get_tcb send s' = Some obj'; s' = s\<rbrakk> \<Longrightarrow> ((if can_grant then (=) s' and (\<lambda>s. True \<and> True) else (\<lambda>_. True)) and (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (can_grant \<longrightarrow> valid_idle s \<and> ?thread464 rv obj' obj'a etcb rva s'a s' \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (valid_objs and valid_objs and (\<lambda>a. True \<and> True \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj'a) msg_info_register)) \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a \<and> valid_idle a \<and> recv \<noteq> idle_thread a \<and> valid_etcbs a)) s) \<and> (\<not> can_grant \<longrightarrow> valid_idle s \<and> not_idle_thread (?thread529 rv obj' obj'a etcb rva s'a s') s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> tcb_at recv s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_global_refs s \<and> valid_irq_node s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> (\<forall>x\<in>set []. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (msg_max_length + length [])) < max_ipc_length \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s))) s
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (7 subgoals):
 1. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> (can_grant \<longrightarrow> ?thread464 rv obj' obj' etcb rva s s \<noteq> idle_thread s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length \<and> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))) \<and> (\<not> can_grant \<longrightarrow> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length)
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (8 subgoals):
 1. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> can_grant \<longrightarrow> ?thread464 rv obj' obj' etcb rva s s \<noteq> idle_thread s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length \<and> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))
 2. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> \<not> can_grant \<longrightarrow> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (8 subgoals):
 1. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; get_tcb send s = Some obj'; tcb_at recv s; tcb_at send s\<rbrakk> \<Longrightarrow> can_grant \<longrightarrow> ?thread464 rv obj' obj' etcb rva s s \<noteq> idle_thread s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length \<and> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))
 2. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> \<not> can_grant \<longrightarrow> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (8 subgoals):
 1. \<And>rv obj' etcb rva s tcb. \<lbrakk>ep' = ep; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; kheap s send = Some (TCB obj'); kheap s recv = Some (TCB tcb); can_grant\<rbrakk> \<Longrightarrow> ?thread464 rv obj' obj' etcb rva s s \<noteq> idle_thread s \<and> Suc (Suc msg_max_length) < max_ipc_length \<and> ?thread529 rv obj' obj' etcb rva s s \<noteq> idle_thread s \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))
 2. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> \<not> can_grant \<longrightarrow> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (9 subgoals):
 1. \<And>rv obj' etcb rva s tcb. \<lbrakk>ep' = ep; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; kheap s send = Some (TCB obj'); kheap s recv = Some (TCB tcb); can_grant\<rbrakk> \<Longrightarrow> ?thread464 rv obj' obj' etcb rva s s \<noteq> idle_thread s
 2. \<And>rv obj' etcb rva s tcb. \<lbrakk>ep' = ep; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; kheap s send = Some (TCB obj'); kheap s recv = Some (TCB tcb); can_grant\<rbrakk> \<Longrightarrow> Suc (Suc msg_max_length) < max_ipc_length \<and> ?thread529 rv obj' obj' etcb rva s s \<noteq> idle_thread s \<and> valid_message_info (data_to_message_info (arch_tcb_context_get (tcb_arch obj') msg_info_register))
 3. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> \<not> can_grant \<longrightarrow> not_idle_thread (?thread529 rv obj' obj' etcb rva s s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 6. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 7. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv)
flex-flex pairs:
\<lambda>rv obj' etcb rva s'. ?thread529 rv obj' obj' etcb rva s' s' \<equiv>\<^sup>? \<lambda>rv obj' etcb rva s'. ?thread464 rv obj' obj' etcb rva s' s' proof (prove)
goal (8 subgoals):
 1. \<And>obj' etcb s tcb. \<lbrakk>ep' = ep; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; kheap s send = Some (TCB obj'); kheap s recv = Some (TCB tcb); can_grant\<rbrakk> \<Longrightarrow> Suc (Suc msg_max_length) < max_ipc_length
 2. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> \<not> can_grant \<longrightarrow> not_idle_thread (cur_thread s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 5. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'\<rbrakk> \<Longrightarrow> \<not> can_grant \<longrightarrow> not_idle_thread (cur_thread s) s \<and> not_idle_thread recv s \<and> tcb_at recv s \<and> Suc (Suc msg_max_length) < max_ipc_length
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; evalMonad (lookup_ipc_buffer False send) s = Some rva; get_tcb send s = Some obj'; \<not> can_grant\<rbrakk> \<Longrightarrow> \<exists>tcb. get_tcb recv s = Some tcb
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (7 subgoals):
 1. \<And>rv obj' etcb rva s. \<lbrakk>ep' = ep; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_etcb send s = Some etcb; tcb_fault obj' = None; get_tcb send s = Some obj'; \<not> can_grant; tcb_at recv s; tcb_at send s\<rbrakk> \<Longrightarrow> \<exists>tcb. get_tcb recv s = Some tcb
 2. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer False send)
 3. \<And>rv s'a obj' etcb. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = None\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s'a) (lookup_ipc_buffer False send)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 5. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- do caps <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
y <- corrupt_ipc_buffer recv True;
Endpoint_D.transfer_caps ep caps send recv
od \<sqinter> corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case tcb_fault obj' of None \<Rightarrow> do send_buffer <- lookup_ipc_buffer False send;
do_normal_transfer send send_buffer ep badge can_grant recv rv
od | Some f \<Rightarrow> do_fault_transfer badge send recv rv)
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do x <- if can_grant then Endpoint_D.lookup_extra_caps send (cdl_intent_extras (cdl_tcb_intent \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable obj'), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable obj'), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply obj'), tcb_caller_slot \<mapsto> transform_cap (tcb_caller obj'), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe obj'), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op send (tcb_state obj'), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification obj')], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler obj'), cdl_tcb_intent = transform_full_intent (machine_state s'a) send obj', cdl_tcb_has_fault = \<exists>y. tcb_fault obj' = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr>)) <catch> (\<lambda>_. return []) else return [];
xa <- corrupt_ipc_buffer recv True;
y <- Endpoint_D.transfer_caps ep x send recv;
corrupt_tcb_intent recv
od \<sqinter> do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do fault <- thread_get tcb_fault send;
f <- case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f;
(label, msg) <- make_fault_msg f send;
sent <- set_mrs recv rv msg;
y <- set_message_info recv (MI sent 0 0 label);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s'a)) ((=) s'a) (do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do fault <- thread_get tcb_fault send;
f <- case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f;
(label, msg) <- make_fault_msg f send;
sent <- set_mrs recv rv msg;
y <- set_message_info recv (MI sent 0 0 label);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (6 subgoals):
 1. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc (?Q704 rv s'a obj' etcb a) (?Q'704 rv s'a obj' etcb a) (do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do fault <- thread_get tcb_fault send;
f <- case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f;
(label, msg) <- make_fault_msg f send;
sent <- set_mrs recv rv msg;
y <- set_message_info recv (MI sent 0 0 label);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q704 rv s'a obj' etcb a s
 3. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'704 rv s'a obj' etcb a s
 4. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 5. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 6. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (9 subgoals):
 1. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc (?Q704 rv s'a obj' etcb a) (?Q'708 rv s'a obj' etcb a fault) (do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do f <- case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f;
(label, msg) <- make_fault_msg f send;
sent <- set_mrs recv rv msg;
y <- set_message_info recv (MI sent 0 0 label);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
 3. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
 5. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q704 rv s'a obj' etcb a s
 6. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'704 rv s'a obj' etcb a s
 7. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 9. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (12 subgoals):
 1. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc (?Q704 rv s'a obj' etcb a) (?Q'713 rv s'a obj' etcb a fault f) (do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do (label, msg) <- make_fault_msg f send;
sent <- set_mrs recv rv msg;
y <- set_message_info recv (MI sent 0 0 label);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 3. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
 5. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
 6. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
 8. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; transform s'a = s\<rbrakk> \<Longrightarrow> ?Q704 rv s'a obj' etcb a s
 9. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'704 rv s'a obj' etcb a s
 10. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s'a obj' etcb a fault f rva. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc (?Q704 rv s'a obj' etcb a) (?Q'718 rv s'a obj' etcb a fault f rva) (do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (case rva of (label, msg) \<Rightarrow> do sent <- set_mrs recv rv msg;
y <- set_message_info recv (MI sent 0 0 label);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>?Q'718 rv s'a obj' etcb a fault f\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 5. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 6. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
 9. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> dcorres dc (?Q704 rv s'a obj' etcb a) (?Q'718 rv s'a obj' etcb a fault f (aa, b)) (do y <- corrupt_ipc_buffer recv True;
corrupt_tcb_intent recv
od) (do sent <- set_mrs recv rv b;
y <- set_message_info recv (MI sent 0 0 aa);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>?Q'718 rv s'a obj' etcb a fault f\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 5. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 6. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
 8. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
 9. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> dcorres dc (?R725 rv s'a obj' etcb a fault f aa b y) (?R'725 rv s'a obj' etcb a fault f aa b sent) (corrupt_tcb_intent recv) (do y <- set_message_info recv (MI sent 0 0 aa);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q734 rv s'a obj' etcb a\<rbrace> corrupt_ipc_buffer recv True \<lbrace>?R725 rv s'a obj' etcb a fault f aa b\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 rv s'a obj' etcb a fault f (aa, b)\<rbrace> set_mrs recv rv b \<lbrace>?R'725 rv s'a obj' etcb a fault f aa b\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>\<lambda>b. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread732 rv s'a obj' etcb a fault f b) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'731 rv s'a obj' etcb a fault f b\<rbrace>
 5. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 7. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 8. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> dcorres dc (?R725 rv s'a obj' etcb a fault f aa b y) (?R'725 rv s'a obj' etcb a fault f aa b sent) (do corrupt_tcb_intent recv;
corrupt_tcb_intent recv
od) (do y <- set_message_info recv (MI sent 0 0 aa);
as_user recv (setRegister badge_register badge)
od)
 2. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q734 rv s'a obj' etcb a\<rbrace> corrupt_ipc_buffer recv True \<lbrace>?R725 rv s'a obj' etcb a fault f aa b\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 rv s'a obj' etcb a fault f (aa, b)\<rbrace> set_mrs recv rv b \<lbrace>?R'725 rv s'a obj' etcb a fault f aa b\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>\<lambda>b. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread732 rv s'a obj' etcb a fault f b) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'731 rv s'a obj' etcb a fault f b\<rbrace>
 5. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 7. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 8. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
 10. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv s'a obj' etcb a fault f aa b y sent rva rv'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R740 rv s'a obj' etcb a fault f aa b y sent rva) (?R'740 rv s'a obj' etcb a fault f aa b y sent rv') (K_bind (corrupt_tcb_intent recv) rva) (as_user recv (setRegister badge_register badge))
 2. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> \<lbrace>?Q742 rv s'a obj' etcb a fault f aa b y\<rbrace> corrupt_tcb_intent recv \<lbrace>?R740 rv s'a obj' etcb a fault f aa b y sent\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 rv s'a obj' etcb a fault f aa b sent\<rbrace> set_message_info recv (MI sent 0 0 aa) \<lbrace>?R'740 rv s'a obj' etcb a fault f aa b y sent\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q734 rv s'a obj' etcb a\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q742 rv s'a obj' etcb a fault f aa b y\<rbrace>
 5. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 rv s'a obj' etcb a fault f (aa, b)\<rbrace> set_mrs recv rv b \<lbrace>\<lambda>sent. valid_idle and not_idle_thread recv and valid_etcbs and ?Q'744 rv s'a obj' etcb a fault f aa b sent\<rbrace>
 6. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>\<lambda>b. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread732 rv s'a obj' etcb a fault f b) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'731 rv s'a obj' etcb a fault f b\<rbrace>
 7. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 9. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 10. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>rv s'a obj' etcb a fault f aa b y sent rva rv'. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent; dc rva rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R740 rv s'a obj' etcb a fault f aa b y sent rva) (?R'740 rv s'a obj' etcb a fault f aa b y sent rv') (corrupt_tcb_intent recv) (as_user recv (setRegister badge_register badge))
 2. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> \<lbrace>?Q742 rv s'a obj' etcb a fault f aa b y\<rbrace> corrupt_tcb_intent recv \<lbrace>?R740 rv s'a obj' etcb a fault f aa b y sent\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 rv s'a obj' etcb a fault f aa b sent\<rbrace> set_message_info recv (MI sent 0 0 aa) \<lbrace>?R'740 rv s'a obj' etcb a fault f aa b y sent\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q734 rv s'a obj' etcb a\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q742 rv s'a obj' etcb a fault f aa b y\<rbrace>
 5. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 rv s'a obj' etcb a fault f (aa, b)\<rbrace> set_mrs recv rv b \<lbrace>\<lambda>sent. valid_idle and not_idle_thread recv and valid_etcbs and ?Q'744 rv s'a obj' etcb a fault f aa b sent\<rbrace>
 6. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>\<lambda>b. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread732 rv s'a obj' etcb a fault f b) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'731 rv s'a obj' etcb a fault f b\<rbrace>
 7. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 9. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 10. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> \<lbrace>?Q742 rv s'a obj' etcb a fault f aa b y\<rbrace> corrupt_tcb_intent recv \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>rv s'a obj' etcb a fault f aa b y sent. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; dc y sent\<rbrakk> \<Longrightarrow> \<lbrace>?Q'744 rv s'a obj' etcb a fault f aa b sent\<rbrace> set_message_info recv (MI sent 0 0 aa) \<lbrace>\<lambda>rv'. valid_idle and not_idle_thread recv and valid_etcbs\<rbrace>
 3. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q734 rv s'a obj' etcb a\<rbrace> corrupt_ipc_buffer recv True \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q742 rv s'a obj' etcb a fault f aa b y\<rbrace>
 4. \<And>rv s'a obj' etcb a fault f aa b. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'731 rv s'a obj' etcb a fault f (aa, b)\<rbrace> set_mrs recv rv b \<lbrace>\<lambda>sent. valid_idle and not_idle_thread recv and valid_etcbs and ?Q'744 rv s'a obj' etcb a fault f aa b sent\<rbrace>
 5. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'713 rv s'a obj' etcb a fault f\<rbrace> make_fault_msg f send \<lbrace>\<lambda>b. (\<lambda>s. evalMonad (lookup_ipc_buffer True recv) s = Some rv) and valid_idle and not_idle_thread (?thread732 rv s'a obj' etcb a fault f b) and not_idle_thread recv and tcb_at recv and valid_objs and pspace_aligned and pspace_distinct and valid_etcbs and ?Q'731 rv s'a obj' etcb a fault f b\<rbrace>
 6. \<And>rv s'a obj' etcb a fault f s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'713 rv s'a obj' etcb a fault f s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> make_fault_msg f send \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>rv s'a obj' etcb a fault f. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'713 rv s'a obj' etcb a fault f) (make_fault_msg f send)
 8. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>?Q'713 rv s'a obj' etcb a fault\<rbrace>
 9. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
A total of 18 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'708 rv s'a obj' etcb a fault\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>f s. evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> valid_idle s \<and> ?thread833 rv s'a obj' etcb a fault f \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>rv s'a obj' etcb a fault s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'708 rv s'a obj' etcb a fault s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>rv s'a obj' etcb a fault. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'708 rv s'a obj' etcb a fault) (case fault of None \<Rightarrow> fail | Some f \<Rightarrow> return f)
 4. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>?Q'708 rv s'a obj' etcb a\<rbrace>
 5. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
 7. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) s
 8. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'704 rv s'a obj' etcb a s
 9. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 10. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
A total of 11 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>fault s. \<forall>x. fault = Some x \<longrightarrow> evalMonad (lookup_ipc_buffer True recv) s = Some rv \<and> valid_idle s \<and> ?thread884 rv s'a obj' etcb a (Some x) x \<noteq> idle_thread s \<and> recv \<noteq> idle_thread s \<and> tcb_at recv s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s \<and> valid_idle s \<and> recv \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
 4. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) s
 5. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'704 rv s'a obj' etcb a s
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (8 subgoals):
 1. \<And>rv s'a obj' etcb a x. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'704 rv s'a obj' etcb a\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>b c. evalMonad (lookup_ipc_buffer True recv) c = Some rv \<and> valid_idle c \<and> ?thread884 rv s'a obj' etcb a (Some x) x \<noteq> idle_thread c \<and> recv \<noteq> idle_thread c \<and> tcb_at recv c \<and> valid_objs c \<and> pspace_aligned c \<and> pspace_distinct c \<and> valid_etcbs c \<and> valid_idle c \<and> recv \<noteq> idle_thread c \<and> valid_etcbs c \<and> valid_idle c \<and> recv \<noteq> idle_thread c \<and> valid_etcbs c\<rbrace>
 2. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; ?Q'704 rv s'a obj' etcb a s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> thread_get tcb_fault send \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>rv s'a obj' etcb a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; False\<rbrakk> \<Longrightarrow> no_fail (?Q'704 rv s'a obj' etcb a) (thread_get tcb_fault send)
 4. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; transform s'a = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>a. True \<and> True)) s
 5. \<And>rv s'a obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s'a = Some rv; valid_objs s'a; pspace_aligned s'a; valid_global_refs s'a; pspace_distinct s'a; valid_mdb s'a; cur_thread s'a \<noteq> idle_thread s'a; valid_irq_node s'a; valid_idle s'a; recv \<noteq> idle_thread s'a; send \<noteq> idle_thread s'a; valid_etcbs s'a; get_tcb send s'a = Some obj'; get_etcb send s'a = Some etcb; tcb_fault obj' = Some a; s'a = s\<rbrakk> \<Longrightarrow> ?Q'704 rv s'a obj' etcb a s
 6. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 7. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 8. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_tcb send s = Some obj'; get_etcb send s = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> ?thread900 rv s obj' etcb a \<noteq> idle_thread s \<and> tcb_at recv s
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal (4 subgoals):
 1. \<And>rv obj' etcb a s. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s = Some rv; valid_objs s; pspace_aligned s; valid_global_refs s; pspace_distinct s; valid_mdb s; cur_thread s \<noteq> idle_thread s; valid_irq_node s; valid_idle s; recv \<noteq> idle_thread s; send \<noteq> idle_thread s; valid_etcbs s; get_tcb send s = Some obj'; get_etcb send s = Some etcb; tcb_fault obj' = Some a\<rbrakk> \<Longrightarrow> tcb_at recv s
 2. \<And>s' rv s s'a. \<lbrakk>ep' = ep; evalMonad (lookup_ipc_buffer True recv) s' = Some rv; valid_objs s'; pspace_aligned s'; valid_global_refs s'; pspace_distinct s'; valid_mdb s'; not_idle_thread (cur_thread s') s'; valid_irq_node s'; valid_idle s'; not_idle_thread recv s'; not_idle_thread send s'; valid_etcbs s'; s = transform s'a; transform s' = s; s' = s'a; get_tcb send s'a \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s send \<noteq> None
 3. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> empty_when_fail (lookup_ipc_buffer True recv)
 4. \<And>s s'. \<lbrakk>ep' = ep; s = transform s'; True; (valid_objs and pspace_aligned and valid_global_refs and pspace_distinct and valid_mdb and (\<lambda>s. not_idle_thread (cur_thread s) s) and valid_irq_node and valid_idle and not_idle_thread recv and not_idle_thread send and valid_etcbs) s'\<rbrakk> \<Longrightarrow> weak_det_spec ((=) s') (lookup_ipc_buffer True recv) proof (prove)
goal:
No subgoals!