theory Tcb_DR

lemma dcorres_tcb_update_ipc_buffer:
  "dcorres (dc \<oplus> dc) (\<top>) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id'
         and valid_pdpt_objs
     and
     (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True
       | Some v \<Rightarrow> case_option True ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) (snd v)
       \<and> (is_aligned (fst v) msg_align_bits) ) and
    case_option (\<lambda>_. True) (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) ipc_buffer'
    and case_option (\<lambda>_. True) (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) ipc_buffer' and
    (\<lambda>s. case_option True (\<lambda>x. not_idle_thread (fst a') s) ipc_buffer') )
     (case_option
         (returnOk () \<sqinter>
           (doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
                liftE $ corrupt_tcb_intent obj_id'
            odE))
           (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a'))
         (translate_tcb_invocation_thread_ctrl_buffer ipc_buffer'))
     (doE y \<leftarrow> case_option (returnOk ())
                       (case_prod
                         (\<lambda>ptr frame.
                             doE cap_delete (obj_id', tcb_cnode_index 4);
                                 liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
                                 liftE $
                                 case_option (return ())
                                  (case_prod
                                    (\<lambda>new_cap src_slot.
                                        check_cap_at new_cap src_slot $
                                        check_cap_at (cap.ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4)))
                                  frame;
                              cur \<leftarrow> liftE $ gets cur_thread;
                              liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
                             odE))
                       ipc_buffer';
                  returnOk []
              odE)" apply (case_tac ipc_buffer') apply (simp_all add:translate_tcb_invocation_thread_ctrl_buffer_def) apply (rule corres_alternate1) apply (rule corres_guard_imp[OF dcorres_returnOk],clarsimp+) apply (clarsimp simp:bindE_assoc split:option.splits,intro conjI) apply (clarsimp) apply (rule corres_alternate2) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule dcorres_tcb_empty_slot) apply (simp add:transform_tcb_slot_4) apply (clarsimp simp:liftE_bindE) apply (simp add:liftE_def) apply (rule corres_split[OF dcorres_corrupt_tcb_intent_ipcbuffer_upd]) apply (rule corres_dummy_return_pl) apply (clarsimp simp:returnOk_def) apply (rule corres_symb_exec_r) apply (rule corres_guard_imp) apply (rule corres_split_noop_rhs) apply (clarsimp simp: when_def) apply (rule reschedule_required_dcorres[THEN corres_trivial]) apply (rule corres_trivial) apply simp apply wpsimp+ apply (rule validE_validE_R) apply (rule_tac Q = "\<lambda>r s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s  \<and> tcb_at obj_id' s"
        in hoare_post_impErr[where E="\<lambda>x. \<top>"]) apply (simp add:not_idle_thread_def) apply (wp cap_delete_cte_at cap_delete_deletes) apply (clarsimp simp:invs_def valid_state_def not_idle_thread_def) apply (clarsimp simp :emptyable_def not_idle_thread_def)+ apply (erule tcb_at_cte_at) apply (simp add:tcb_cap_cases_def) 
  (* Main Part *)
   apply (clarsimp simp:tcb_update_ipc_buffer_def tcb_update_thread_slot_def  transform_tcb_slot_simp[symmetric]) apply (drule_tac s="transform_cslot_ptr a" for a in sym) apply (clarsimp simp:check_cap_at_def) apply (rule dcorres_expand_pfx) apply (subst alternative_com) apply (rule corres_guard_imp) apply (rule corres_splitEE) apply (rule dcorres_tcb_empty_slot) apply (simp add:transform_tcb_slot_4) apply (clarsimp simp:tcb_update_thread_slot_def whenE_liftE) apply (clarsimp simp:liftE_bindE) apply (rule corres_split[OF dcorres_corrupt_tcb_intent_ipcbuffer_upd]) apply (clarsimp simp:bind_assoc) apply (rule corres_dummy_return_pl) apply simp apply (rule corres_split) apply (rule get_cap_corres; simp) apply (clarsimp simp:liftE_def returnOk_def) apply (rule corres_split) apply (rule corres_when) apply (rule arch_same_obj_as_lift) apply (simp add:valid_ipc_buffer_cap_def is_arch_cap_def split:cap.splits) apply (clarsimp simp: valid_cap_def is_arch_cap_def valid_ipc_buffer_cap_def
                            split: cap.split_asm arch_cap.split_asm)+ apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule corres_when) apply (rule sym) apply (case_tac cap') apply (clarsimp simp:same_object_as_def)+ apply (simp add:transform_cap_def split:arch_cap.splits) apply (rule dcorres_insert_cap_combine) apply clarsimp apply wp apply (rule_tac Q = "\<lambda>r s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s
                                        \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s
                                        \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s
                                        \<and> valid_mdb s \<and> valid_objs s\<and> not_idle_thread ab s \<and> valid_etcbs s
                                        \<and> ((is_thread_cap r \<and> obj_ref_of r = obj_id') \<longrightarrow>
                                            ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 4) s)"
                    in hoare_strengthen_post) apply (wp get_cap_ex_cte_cap_wp_to,clarsimp) apply (clarsimp simp:same_object_as_def) apply (drule ex_cte_cap_to_not_idle, auto simp: not_idle_thread_def)[1] apply (rule corres_trivial,clarsimp simp:returnOk_def) apply (rule corres_symb_exec_r) apply (rule corres_guard_imp) apply (rule corres_split_noop_rhs) apply (clarsimp simp: when_def) apply (rule reschedule_required_dcorres[THEN corres_trivial]) apply (rule corres_trivial) apply simp apply wp apply simp apply simp apply wp apply wp apply wpsimp apply (wp when_wp)+ apply (rule hoare_strengthen_post[OF hoare_TrueI[where P = \<top>]],clarsimp+) apply (wp wp_post_taut hoare_drop_imp get_cap_weak_wp)+ apply (clarsimp simp:conj_comms) apply (wp thread_set_global_refs_triv thread_set_valid_idle) apply (clarsimp simp:tcb_cap_cases_def) apply (wp thread_set_valid_idle thread_set_valid_irq_node) apply (fastforce simp:tcb_cap_cases_def) apply (wp thread_set_mdb) apply (fastforce simp:tcb_cap_cases_def) apply (simp add:not_idle_thread_def) apply (wp thread_set_cte_at update_ipc_buffer_valid_objs thread_set_valid_cap thread_set_cte_wp_at_trivial) apply (fastforce simp:tcb_cap_cases_def) apply (simp add: transform_tcb_slot_4) apply (rule hoare_post_impErr[OF validE_R_validE[OF hoare_True_E_R]]) apply simp+ apply (rule_tac Q = "\<lambda>r s. invs s \<and> valid_etcbs s \<and> not_idle_thread (fst a') s \<and> tcb_at obj_id' s
      \<and> not_idle_thread obj_id' s \<and> not_idle_thread ab s \<and> cte_wp_at (\<lambda>a. True) (ab,ba) s
      \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> is_aligned a msg_align_bits"
      in hoare_post_impErr[where E="\<lambda>x. \<top>"]) apply (simp add:not_idle_thread_def) apply (wp cap_delete_cte_at cap_delete_deletes cap_delete_valid_cap) apply (clarsimp simp:invs_valid_objs invs_mdb invs_valid_idle) apply (clarsimp simp:invs_def  valid_state_def not_idle_thread_def) apply (erule cte_wp_at_weakenE, erule sym) apply simp apply simp apply (clarsimp simp:emptyable_def not_idle_thread_def) apply (erule tcb_at_cte_at,clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)) (case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
returnOk []
odE) proof (prove)
goal (2 subgoals):
 1. ipc_buffer' = None \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)) (case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
returnOk []
odE)
 2. \<And>a. ipc_buffer' = Some a \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. case ipc_buffer' of None \<Rightarrow> True | Some v \<Rightarrow> (case snd v of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst v) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst v) msg_align_bits) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (cte_wp_at (\<lambda>_. True) \<circ> snd) \<circ> snd) x) and (case ipc_buffer' of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (case_option (\<lambda>_. True) (not_idle_thread \<circ> fst \<circ> snd) \<circ> snd) x) and (\<lambda>s. case ipc_buffer' of None \<Rightarrow> True | Some x \<Rightarrow> not_idle_thread (fst a') s)) (case translate_tcb_invocation_thread_ctrl_buffer ipc_buffer' of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- case ipc_buffer' of None \<Rightarrow> returnOk () | Some (ptr, frame) \<Rightarrow> doE cap_delete (obj_id', tcb_cnode_index 4);
liftE $ thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id';
liftE $ case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4);
cur <- liftE $ gets cur_thread;
liftE $ when (obj_id' = cur) (do_extended_op reschedule_required)
odE;
returnOk []
odE) proof (prove)
goal (2 subgoals):
 1. ipc_buffer' = None \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt)) (returnOk () \<sqinter> doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE (corrupt_tcb_intent obj_id')
odE) (returnOk [])
 2. \<And>a. ipc_buffer' = Some a \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. (case snd a of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst a) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst a) msg_align_bits) and (case snd a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case snd a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and not_idle_thread (fst a')) (case case a of (a, None) \<Rightarrow> None | (a, Some (c, d)) \<Rightarrow> Some (transform_cap c, transform_cslot_ptr d) of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- case a of (ptr, frame) \<Rightarrow> doE y <- cap_delete (obj_id', tcb_cnode_index 4);
y <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id');
y <- liftE (case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4));
cur <- liftE (gets cur_thread);
liftE (when (obj_id' = cur) reschedule_required)
odE;
returnOk []
odE) proof (prove)
goal (2 subgoals):
 1. ipc_buffer' = None \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. Ball (ran (kheap s)) obj_valid_pdpt)) (returnOk ()) (returnOk [])
 2. \<And>a. ipc_buffer' = Some a \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. (case snd a of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst a) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned (fst a) msg_align_bits) and (case snd a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case snd a of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and not_idle_thread (fst a')) (case case a of (a, None) \<Rightarrow> None | (a, Some (c, d)) \<Rightarrow> Some (transform_cap c, transform_cslot_ptr d) of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- case a of (ptr, frame) \<Rightarrow> doE y <- cap_delete (obj_id', tcb_cnode_index 4);
y <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. ptr)) obj_id');
y <- liftE (case frame of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4));
cur <- liftE (gets cur_thread);
liftE (when (obj_id' = cur) reschedule_required)
odE;
returnOk []
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. (case b of None \<Rightarrow> True | Some x \<Rightarrow> ((swp valid_ipc_buffer_cap (fst (a, b)) and is_arch_cap and cap_aligned) \<circ> fst) x) \<and> is_aligned a msg_align_bits) and (case b of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (cte_wp_at (\<lambda>_. True) \<circ> snd) x) and (case b of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> (not_idle_thread \<circ> fst \<circ> snd) x) and not_idle_thread (fst a')) (case case b of None \<Rightarrow> None | Some (c, d) \<Rightarrow> Some (transform_cap c, transform_cslot_ptr d) of None \<Rightarrow> returnOk () \<sqinter> doE tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE $ corrupt_tcb_intent obj_id'
odE | Some x \<Rightarrow> tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') x) (doE y <- doE y <- cap_delete (obj_id', tcb_cnode_index 4);
y <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
y <- liftE (case b of None \<Rightarrow> return () | Some (new_cap, src_slot) \<Rightarrow> check_cap_at new_cap src_slot $ check_cap_at (ThreadCap obj_id') a' $ cap_insert new_cap src_slot (obj_id', tcb_cnode_index 4));
cur <- liftE (gets cur_thread);
liftE (when (obj_id' = cur) reschedule_required)
odE;
returnOk []
odE) proof (prove)
goal (2 subgoals):
 1. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> b = None \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) (returnOk () \<sqinter> doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE (corrupt_tcb_intent obj_id')
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) (returnOk () \<sqinter> doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE (corrupt_tcb_intent obj_id')
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE (corrupt_tcb_intent obj_id')
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (4 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q25 a) (?Q'25 a) (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
liftE (corrupt_tcb_intent obj_id')
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ?Q25 a s
 3. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> ?Q'25 a s
 4. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (7 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> ?r'29 a) (?P29 a) (?P'29 a) (tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot) (cap_delete (obj_id', tcb_cnode_index 4))
 2. \<And>a y x. \<lbrakk>ipc_buffer' = Some (a, None); ?r'29 a y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R29 a y) (?R'29 a x) (liftE (corrupt_tcb_intent obj_id')) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> (?P29 a and ?Q29 a) s
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (?P'29 a and ?Q'29 a) s
 7. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (7 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> (obj_id', tcb_ipcbuffer_slot) = transform_cslot_ptr (obj_id', tcb_cnode_index 4)
 2. \<And>a y x. \<lbrakk>ipc_buffer' = Some (a, None); dc y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R29 a y) (?R'29 a x) (liftE (corrupt_tcb_intent obj_id')) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 7. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (6 subgoals):
 1. \<And>a y x. \<lbrakk>ipc_buffer' = Some (a, None); dc y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R29 a y) (?R'29 a x) (liftE (corrupt_tcb_intent obj_id')) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (return ());
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 6. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (6 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R29 a ()) (?R'29 a ()) (liftE (corrupt_tcb_intent obj_id')) (do x <- thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id';
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 6. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (6 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R29 a ()) (?R'29 a ()) (do r <- corrupt_tcb_intent obj_id';
return (Inr ())
od) (do x <- thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id';
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'29 a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 6. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (8 subgoals):
 1. \<And>a r x. \<lbrakk>ipc_buffer' = Some (a, None); dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R38 a r) (?R'38 a x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'42 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 7. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 8. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (8 subgoals):
 1. \<And>a r x. \<lbrakk>ipc_buffer' = Some (a, None); dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R38 a r) (?R'38 a x) (do return (?b47 a r x);
return (Inr ())
od) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'42 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 7. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 8. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (8 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R38 a ()) (?R'38 a ()) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 3. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'42 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 7. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
 8. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (11 subgoals):
 1. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R38 a ()) (?Q'51 a x) (return (Inr ())) (do y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 3. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 5. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 6. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 7. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'42 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q29 a) s
 10. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'29 a) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q56 a x) (?Q'56 a x) (return (Inr ())) (do y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?R38 a () s\<rbrakk> \<Longrightarrow> ?Q56 a x s
 3. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?Q'51 a x s\<rbrakk> \<Longrightarrow> ?Q'56 a x s
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 7. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 8. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 9. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'42 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres dc (?P61 a x) (?P'61 a x) (return ()) (when (obj_id' = x) reschedule_required)
 2. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R61 a x) (?R'61 a x) (return (Inr ())) (return (Inr []))
 3. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'61 a x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>xa. ?R'61 a x\<rbrace>
 4. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?R38 a () s\<rbrakk> \<Longrightarrow> (?P61 a x and ?R61 a x) s
 5. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?Q'51 a x s\<rbrakk> \<Longrightarrow> (?P'61 a x and ?Q'61 a x) s
 6. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 7. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 9. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 10. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres dc (?P61 a obj_id') (?P'61 a obj_id') (return ()) reschedule_required
 2. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R61 a x) (?R'61 a x) (return (Inr ())) (return (Inr []))
 3. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'61 a x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>xa. ?R'61 a x\<rbrace>
 4. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?R38 a () s\<rbrakk> \<Longrightarrow> (?P61 a x and ?R61 a x) s
 5. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?Q'51 a x s\<rbrakk> \<Longrightarrow> (?P'61 a x and ?Q'61 a x) s
 6. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 7. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 9. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 10. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (?R61 a x) (?R'61 a x) (return (Inr ())) (return (Inr []))
 2. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'61 a x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>xa. ?R'61 a x\<rbrace>
 3. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?R38 a () s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R61 a x) s
 4. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?Q'51 a x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q'61 a x) s
 5. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 8. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 9. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 10. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (return (Inr ())) (return (Inr []))
 2. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'61 a x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?R38 a () s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s
 4. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?Q'51 a x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q'61 a x) s
 5. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 6. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 8. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 9. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 10. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a x. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'61 a x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?R38 a () s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s
 3. \<And>a x s. \<lbrakk>ipc_buffer' = Some (a, None); ?Q'51 a x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q'61 a x) s
 4. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?R'38 a ()\<rbrace> gets cur_thread \<lbrace>?Q'51 a\<rbrace>
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); ?R'38 a () s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a. \<lbrakk>ipc_buffer' = Some (a, None); False\<rbrakk> \<Longrightarrow> no_fail (?R'38 a ()) (gets cur_thread)
 7. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q43 a ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R38 a\<rbrace>
 8. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'42 a ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'38 a\<rbrace>
 9. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q29 a\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q43 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?Q'29 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'42 a b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?P'136 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>rv s. valid_idle s \<and> not_idle_thread obj_id' s \<and> valid_etcbs s\<rbrace>, -
 2. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>s. True \<and> tcb_at obj_id' s \<and> ?P'136 a s)) s
 4. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (4 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?P'136 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>rv s. valid_idle s \<and> not_idle_thread obj_id' s \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>s. True \<and> tcb_at obj_id' s \<and> ?P'136 a s)) s
 4. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (6 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?P'136 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>r s. invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s\<rbrace>, \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>a rv s. \<lbrakk>ipc_buffer' = Some (a, None); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread obj_id' s \<and> valid_etcbs s
 3. \<And>a e s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> True
 4. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>s. True \<and> tcb_at obj_id' s \<and> ?P'136 a s)) s
 6. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (6 subgoals):
 1. \<And>a. ipc_buffer' = Some (a, None) \<Longrightarrow> \<lbrace>?P'136 a\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>r s. invs s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s\<rbrace>, \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>a rv s. \<lbrakk>ipc_buffer' = Some (a, None); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread obj_id' s \<and> valid_etcbs s
 3. \<And>a e s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> True
 4. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 5. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>s. True \<and> tcb_at obj_id' s \<and> ?P'136 a s)) s
 6. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (5 subgoals):
 1. \<And>a rv s. \<lbrakk>ipc_buffer' = Some (a, None); invs s \<and> valid_etcbs s \<and> not_idle_thread obj_id' s \<and> tcb_at obj_id' s\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread obj_id' s \<and> valid_etcbs s
 2. \<And>a e s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> True
 3. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 4. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>s. True \<and> tcb_at obj_id' s \<and> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s)) s
 5. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (4 subgoals):
 1. \<And>a e s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> True
 2. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> True \<and> True)) s
 3. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. is_aligned a msg_align_bits) and not_idle_thread (fst a')) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>s. True \<and> tcb_at obj_id' s \<and> True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) s \<and> valid_etcbs s \<and> obj_id' \<noteq> idle_thread s \<and> tcb_at obj_id' s)) s
 4. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); invs s; valid_etcbs s; tcb_at obj_id' s; obj_id' \<noteq> idle_thread s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned a msg_align_bits; fst a' \<noteq> idle_thread s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) s
 2. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (2 subgoals):
 1. \<And>a s. \<lbrakk>ipc_buffer' = Some (a, None); invs s; valid_etcbs s; obj_id' \<noteq> idle_thread s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; is_aligned a msg_align_bits; fst a' \<noteq> idle_thread s\<rbrakk> \<Longrightarrow> tcb_cnode_index 4 \<in> dom tcb_cap_cases
 2. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>a b. ipc_buffer' = Some (a, b) \<Longrightarrow> \<forall>aa ab ba. b = Some (aa, ab, ba) \<longrightarrow> (\<forall>ac b. transform_cslot_ptr (ab, ba) = (ac, b) \<longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (tcb_update_ipc_buffer obj_id' (transform_cslot_ptr a') (transform_cap aa, ac, b)) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); transform_cslot_ptr (ab, ba) = (ac, bb)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (ac, bb));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aa) (ac, bb) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_sibling (transform_cap aa) (ac, bb) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (ac, bb));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aa) (ac, bb) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_sibling (transform_cap aa) (ac, bb) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (check_cap_at aa (ab, ba) (check_cap_at (ThreadCap obj_id') a' (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))));
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE) proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) ((=) s) ((=) s') (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE) proof (prove)
goal (3 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q181 a aa ab ba ac bb s s') (?Q'181 a aa ab ba ac bb s s') (doE y <- tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot;
y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- cap_delete (obj_id', tcb_cnode_index 4);
x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ?Q181 a aa ab ba ac bb s s' sa
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> ?Q'181 a aa ab ba ac bb s s' sa proof (prove)
goal (6 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'185 a aa ab ba ac bb s s') (?P185 a aa ab ba ac bb s s') (?P'185 a aa ab ba ac bb s s') (tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot) (cap_delete (obj_id', tcb_cnode_index 4))
 2. \<And>a aa ab ba ac bb s s' y x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; ?r'185 a aa ab ba ac bb s s' y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R185 a aa ab ba ac bb s s' y) (?R'185 a aa ab ba ac bb s s' x) (doE y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> (?P185 a aa ab ba ac bb s s' and ?Q185 a aa ab ba ac bb s s') sa
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (?P'185 a aa ab ba ac bb s s' and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> (obj_id', tcb_ipcbuffer_slot) = transform_cslot_ptr (obj_id', tcb_cnode_index 4)
 2. \<And>a aa ab ba ac bb s s' y x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; dc y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R185 a aa ab ba ac bb s s' y) (?R'185 a aa ab ba ac bb s s' x) (doE y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s s' y x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; dc y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R185 a aa ab ba ac bb s s' y) (?R'185 a aa ab ba ac bb s s' x) (doE y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
whenE (cdl_same_arch_obj_as (transform_cap aa) src_cap) (liftE (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R185 a aa ab ba ac bb (transform s') s' ()) (?R'185 a aa ab ba ac bb (transform s') s' ()) (doE y <- liftE (corrupt_tcb_intent obj_id');
src_cap <- liftE (KHeap_D.get_cap (transform_cslot_ptr (ab, ba)));
liftE (when (cdl_same_arch_obj_as (transform_cap aa) src_cap) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
odE) (doE x <- liftE (thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id');
x <- liftE (do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od);
x <- liftE (gets cur_thread);
y <- liftE (when (obj_id' = x) reschedule_required);
returnOk []
odE)
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R185 a aa ab ba ac bb (transform s') s' ()) (?R'185 a aa ab ba ac bb (transform s') s' ()) (do y <- corrupt_tcb_intent obj_id';
src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ab, ba));
liftE (when (cdl_same_arch_obj_as (transform_cap aa) src_cap) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
od) (do x <- thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id';
x <- do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od;
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>?R185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>?R'185 a aa ab ba ac bb s s'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>a aa ab ba ac bb s' y x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc y x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R212 a aa ab ba ac bb s' y) (?R'212 a aa ab ba ac bb s' x) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ab, ba));
liftE (when (cdl_same_arch_obj_as (transform_cap aa) src_cap) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
od) (do x <- do cap' <- CSpaceAcc_A.get_cap (ab, ba);
when (same_object_as aa cap') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
od;
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R212 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'212 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 7. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R212 a aa ab ba ac bb s' ()) (?R'212 a aa ab ba ac bb s' ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ab, ba));
liftE (when (cdl_same_arch_obj_as (transform_cap aa) src_cap) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
od) (do x <- CSpaceAcc_A.get_cap (ab, ba);
x <- when (same_object_as aa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od);
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R212 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'212 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 7. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R212 a aa ab ba ac bb s' ()) (?R'212 a aa ab ba ac bb s' ()) (do return (?b223 a aa ab ba ac bb s');
src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ab, ba));
liftE (when (cdl_same_arch_obj_as (transform_cap aa) src_cap) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
od) (do x <- CSpaceAcc_A.get_cap (ab, ba);
x <- when (same_object_as aa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od);
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R212 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'212 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 7. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R212 a aa ab ba ac bb s' ()) (?R'212 a aa ab ba ac bb s' ()) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr (ab, ba));
liftE (when (cdl_same_arch_obj_as (transform_cap aa) src_cap) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))
od) (do x <- CSpaceAcc_A.get_cap (ab, ba);
x <- when (same_object_as aa x) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od);
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>?R212 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>?R'212 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 7. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (10 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (?r'225 a aa ab ba ac bb s') (?P233 a aa ab ba ac bb s' ()) (?P'231 a aa ab ba ac bb s' ()) (KHeap_D.get_cap (transform_cslot_ptr (ab, ba))) (CSpaceAcc_A.get_cap (ab, ba))
 2. \<And>a aa ab ba ac bb s' rv rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?r'225 a aa ab ba ac bb s' rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R225 a aa ab ba ac bb s' rv) (?R'225 a aa ab ba ac bb s' rv') (liftE (when (cdl_same_arch_obj_as (transform_cap aa) rv) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))) (do x <- when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od);
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>?R225 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>?R'225 a aa ab ba ac bb s'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. ?P233 a aa ab ba ac bb s' b and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. ?P'231 a aa ab ba ac bb s' b and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 10. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>a aa ab ba ac bb s' rv rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; rv = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R225 a aa ab ba ac bb s' rv) (?R'225 a aa ab ba ac bb s' rv') (liftE (when (cdl_same_arch_obj_as (transform_cap aa) rv) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od))) (do x <- when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od);
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
returnOk []
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>?R225 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>?R'225 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 9. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R225 a aa ab ba ac bb s' (transform_cap rv')) (?R'225 a aa ab ba ac bb s' rv') (do r <- when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od);
return (Inr ())
od) (do x <- when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od);
x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>?R225 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>?R'225 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 9. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (12 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (?r'247 a aa ab ba ac bb s' rv') (?P251 a aa ab ba ac bb s' (transform_cap rv')) (?P'247 a aa ab ba ac bb s' rv') (when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od)) (when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od))
 2. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?r'247 a aa ab ba ac bb s' rv' r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. ?P251 a aa ab ba ac bb s' b and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. ?P'247 a aa ab ba ac bb s' rv' and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv') = same_object_as aa rv'
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres dc (?P257 a aa ab ba ac bb s' (transform_cap rv')) (?P'256 a aa ab ba ac bb s' rv') (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
 3. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ?P257 a aa ab ba ac bb s' b c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> ?P'256 a aa ab ba ac bb s' rv' x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> cap_aligned aa
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> is_arch_cap aa
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> transform_cap aa = transform_cap aa
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> transform_cap rv' = transform_cap rv'
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres dc (?P257 a aa ab ba ac bb s' (transform_cap rv')) (?P'256 a aa ab ba ac bb s' rv') (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
 6. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ?P257 a aa ab ba ac bb s' b c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> ?P'256 a aa ab ba ac bb s' rv' x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> is_arch_cap aa
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> transform_cap aa = transform_cap aa
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> transform_cap rv' = transform_cap rv'
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres dc (?P257 a aa ab ba ac bb s' (transform_cap rv')) (?P'256 a aa ab ba ac bb s' rv') (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od)
 5. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ?P257 a aa ab ba ac bb s' b c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> ?P'256 a aa ab ba ac bb s' rv' x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
A total of 15 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> dcorres dc (?P257 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')) (?P'256 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv') (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4))
od)
 2. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ?P257 a aa ab ba ac bb s' b c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> ?P'256 a aa ab ba ac bb s' rv' x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> dcorres (?r'363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35) (?P371 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')) (?P'369 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv') (KHeap_D.get_cap (transform_cslot_ptr a')) (CSpaceAcc_A.get_cap a')
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; ?r'363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?R363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap) (?R'363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap') (when (thread_cap = TcbCap obj_id') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))) (when (same_object_as (ThreadCap obj_id') cap') (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4)))
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>?R363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35\<rbrace>
 4. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>?R'363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> (?P371 a aa ab ba ac bb s' b and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (?P'369 a aa ab ba ac bb s' rv' and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?R363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap) (?R'363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap') (when (thread_cap = TcbCap obj_id') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))) (when (same_object_as (ThreadCap obj_id') cap') (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4)))
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>?R363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35\<rbrace>
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>?R'363 a ab ba ac bb s' rv' x31 x32 x33 x34 x35\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> (thread_cap = TcbCap obj_id') = same_object_as (ThreadCap obj_id') cap'
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap) (?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4))) (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4))
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>thread_cap x. thread_cap = TcbCap obj_id' \<longrightarrow> ?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap x\<rbrace>
 4. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> ?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap' x\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap) (?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4))) (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4))
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>thread_cap x. thread_cap = TcbCap obj_id' \<longrightarrow> ?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap x\<rbrace>
 4. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> ?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap' x\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
A total of 15 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.NullCap\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x21 x22 x23 x24. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x31a x32a x33a. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.EndpointCap x31a x32a x33a\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 4. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x41 x42 x43. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 5. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x51 x52 x53. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 6. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x61 x62 x63. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 7. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x7. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = ThreadCap x7\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 8. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = cap.DomainCap\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 9. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = IRQControlCap\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
 10. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap' x10. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'; cap' = IRQHandlerCap x10\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') cap' = (thread_cap = TcbCap obj_id')
A total of 26 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a ab ba ac bb s' x31 x32 x33 x34 x35 x12. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; transform_cap (ArchObjectCap x12) = TcbCap obj_id'\<rbrakk> \<Longrightarrow> False
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap) (?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4))) (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4))
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>thread_cap x. thread_cap = TcbCap obj_id' \<longrightarrow> ?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap x\<rbrace>
 4. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> ?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap' x\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres dc (?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap) (?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap') (insert_cap_sibling (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35)) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4))) (cap_insert (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (ab, ba) (obj_id', tcb_cnode_index 4))
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>thread_cap x. thread_cap = TcbCap obj_id' \<longrightarrow> ?P384 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap x\<rbrace>
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> ?P'386 a ab ba ac bb s' rv' x31 x32 x33 x34 x35 cap' x\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 thread_cap cap'. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; thread_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> FrameCap x31 x32 x33 (pageBitsForSize x34) Real (transform_mapping x35) = transform_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35))
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>thread_cap x. thread_cap = TcbCap obj_id' \<longrightarrow> True\<rbrace>
 3. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) x \<and> cte_wp_at (\<lambda>_. True) (ab, ba) x \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 4)) x \<and> not_idle_thread (fst (ab, ba)) x \<and> valid_mdb x \<and> valid_idle x \<and> valid_etcbs x \<and> valid_objs x \<and> cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35))\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q370 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' (transform_cap rv')\<rbrace> KHeap_D.get_cap (transform_cslot_ptr a') \<lbrace>\<lambda>thread_cap x. thread_cap = TcbCap obj_id' \<longrightarrow> True\<rbrace>
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) x \<and> cte_wp_at (\<lambda>_. True) (ab, ba) x \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 4)) x \<and> not_idle_thread (fst (ab, ba)) x \<and> valid_mdb x \<and> valid_idle x \<and> valid_etcbs x \<and> valid_objs x \<and> cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35))\<rbrace>
 3. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>c. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and ?Q370 a aa ab ba ac bb s' b) c) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>cap' x. same_object_as (ThreadCap obj_id') cap' \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) x \<and> cte_wp_at (\<lambda>_. True) (ab, ba) x \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 4)) x \<and> not_idle_thread (fst (ab, ba)) x \<and> valid_mdb x \<and> valid_idle x \<and> valid_etcbs x \<and> valid_objs x \<and> cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35))\<rbrace>
 2. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'368 a (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>r s. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> valid_etcbs s \<and> (is_thread_cap r \<and> obj_ref_of r = obj_id' \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 4) s)\<rbrace>
 2. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 rv s. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> valid_etcbs s \<and> (is_thread_cap rv \<and> obj_ref_of rv = obj_id' \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 4) s)\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') rv \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 4)) s \<and> not_idle_thread (fst (ab, ba)) s \<and> valid_mdb s \<and> valid_idle s \<and> valid_etcbs s \<and> valid_objs s \<and> cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35))
 3. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and ?Q'368 a aa ab ba ac bb s' rv') x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a ab ba ac bb s' rv' x31 x32 x33 x34 x35 rv s. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> valid_etcbs s \<and> (is_thread_cap rv \<and> obj_ref_of rv = obj_id' \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (obj_id', tcb_cnode_index 4) s)\<rbrakk> \<Longrightarrow> same_object_as (ThreadCap obj_id') rv \<longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> not_idle_thread (fst (obj_id', tcb_cnode_index 4)) s \<and> not_idle_thread (fst (ab, ba)) s \<and> valid_mdb s \<and> valid_idle s \<and> valid_etcbs s \<and> valid_objs s \<and> cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35))
 2. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a ab ba ac bb s' x31 x32 x33 x34 x35 rv s. \<lbrakk>cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ipc_buffer' = Some (a, Some (ArchObjectCap (PageCap x31 x32 x33 x34 x35), ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at (obj_ref_of rv) s'; not_idle_thread (obj_ref_of rv) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned a msg_align_bits; cte_wp_at ((=) cap.NullCap) (obj_ref_of rv, tcb_cnode_index 4) s; cte_wp_at (\<lambda>_. True) (ab, ba) s; valid_global_refs s; valid_idle s; valid_irq_node s; valid_mdb s; valid_objs s; not_idle_thread ab s; valid_etcbs s; ex_cte_cap_wp_to (\<lambda>_. True) (obj_ref_of rv, tcb_cnode_index 4) s; is_thread_cap rv; obj_id' = obj_ref_of rv\<rbrakk> \<Longrightarrow> not_idle_thread (obj_ref_of rv) s
 2. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a aa ab ba ac bb s' rv' r x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; dc r x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R247 a aa ab ba ac bb s' rv' r) (?R'247 a aa ab ba ac bb s' rv' x) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>?R247 a aa ab ba ac bb s' rv'\<rbrace>
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>?R'247 a aa ab ba ac bb s' rv'\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (return (Inr ())) (do x <- gets cur_thread;
y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (?Q'513 a aa ab ba ac bb s' x) (return (Inr ())) (do y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?Q518 a aa ab ba ac bb s' x) (?Q'518 a aa ab ba ac bb s' x) (return (Inr ())) (do y <- when (obj_id' = x) reschedule_required;
return (Inr [])
od)
 2. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> ?Q518 a aa ab ba ac bb s' x s
 3. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> ?Q'518 a aa ab ba ac bb s' x s
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 5. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres dc (?P522 a aa ab ba ac bb s' x) (?P'522 a aa ab ba ac bb s' x) (return ()) (when (obj_id' = x) reschedule_required)
 2. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R522 a aa ab ba ac bb s' x) (?R'522 a aa ab ba ac bb s' x) (return (Inr ())) (return (Inr []))
 3. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'522 a aa ab ba ac bb s' x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>xa. ?R'522 a aa ab ba ac bb s' x\<rbrace>
 4. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> (?P522 a aa ab ba ac bb s' x and ?R522 a aa ab ba ac bb s' x) s
 5. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> (?P'522 a aa ab ba ac bb s' x and ?Q'522 a aa ab ba ac bb s' x) s
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 7. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 9. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres dc (?P522 a aa ab ba ac bb s' obj_id') (?P'522 a aa ab ba ac bb s' obj_id') (return ()) reschedule_required
 2. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R522 a aa ab ba ac bb s' x) (?R'522 a aa ab ba ac bb s' x) (return (Inr ())) (return (Inr []))
 3. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'522 a aa ab ba ac bb s' x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>xa. ?R'522 a aa ab ba ac bb s' x\<rbrace>
 4. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> (?P522 a aa ab ba ac bb s' x and ?R522 a aa ab ba ac bb s' x) s
 5. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> (?P'522 a aa ab ba ac bb s' x and ?Q'522 a aa ab ba ac bb s' x) s
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 7. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 9. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (?R522 a aa ab ba ac bb s' x) (?R'522 a aa ab ba ac bb s' x) (return (Inr ())) (return (Inr []))
 2. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'522 a aa ab ba ac bb s' x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>xa. ?R'522 a aa ab ba ac bb s' x\<rbrace>
 3. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R522 a aa ab ba ac bb s' x) s
 4. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q'522 a aa ab ba ac bb s' x) s
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 6. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 8. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>_. True) (\<lambda>_. True) (return (Inr ())) (return (Inr []))
 2. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'522 a aa ab ba ac bb s' x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s
 4. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q'522 a aa ab ba ac bb s' x) s
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 6. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 8. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a aa ab ba ac bb s' x. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'522 a aa ab ba ac bb s' x\<rbrace> when (obj_id' = x) reschedule_required \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s
 3. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q'522 a aa ab ba ac bb s' x) s
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 5. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True)) s
 2. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>_. True)) s
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 4. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 7. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a aa ab ba ac bb s' x s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; ?Q'513 a aa ab ba ac bb s' x s\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>_. True)) s
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 3. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> gets cur_thread \<lbrace>?Q'513 a aa ab ba ac bb s'\<rbrace>
 2. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a aa ab ba ac bb s' s. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> gets cur_thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>_. True) (gets cur_thread)
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 8. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q250 a aa ab ba ac bb s' (transform_cap rv')\<rbrace> when (cdl_same_arch_obj_as (transform_cap aa) (transform_cap rv')) (do thread_cap <- KHeap_D.get_cap (transform_cslot_ptr a');
when (thread_cap = TcbCap obj_id') (insert_cap_sibling (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)) \<sqinter> insert_cap_child (transform_cap aa) (transform_cslot_ptr (ab, ba)) (transform_cslot_ptr (obj_id', tcb_cnode_index 4)))
od) \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'247 a aa ab ba ac bb s' rv'\<rbrace> when (same_object_as aa rv') (do cap' <- CSpaceAcc_A.get_cap a';
when (same_object_as (ThreadCap obj_id') cap') (cap_insert aa (ab, ba) (obj_id', tcb_cnode_index 4))
od) \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>b. (\<lambda>a. cdl_same_arch_obj_as (transform_cap aa) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) a) and ?Q250 a aa ab ba ac bb s' b\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and ?Q'247 a aa ab ba ac bb s' rv'\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 7. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 10. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (9 subgoals):
 1. \<And>a aa ab ba ac bb s' rv'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; same_object_as aa rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q675 a aa ab ba ac bb s' rv'\<rbrace> CSpaceAcc_A.get_cap a' \<lbrace>\<lambda>x. if same_object_as (ThreadCap obj_id') x then \<lambda>s. True else (\<lambda>_. True)\<rbrace>
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q232 a aa ab ba ac bb s' ()\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (ab, ba)) \<lbrace>\<lambda>a. (\<lambda>b. cdl_same_arch_obj_as (transform_cap aa) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' \<longrightarrow> True)) b) and (if cdl_same_arch_obj_as (transform_cap aa) a then \<lambda>a. opt_cap (transform_cslot_ptr a') a \<noteq> None \<longrightarrow> (if the (opt_cap (transform_cslot_ptr a') a) = TcbCap obj_id' then (\<lambda>_. True) and (\<lambda>_. True) else (\<lambda>_. True)) a else (\<lambda>_. True))\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv'. (\<lambda>x. same_object_as aa rv' \<longrightarrow> (valid_idle and not_idle_thread (fst a') and valid_etcbs and (\<lambda>a. cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a \<and> True)) x) and (if same_object_as aa rv' then ?Q675 a aa ab ba ac bb s' rv' else (\<lambda>_. True))\<rbrace>
 4. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 5. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 6. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 9. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (7 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'230 a aa ab ba ac bb s' ()\<rbrace> CSpaceAcc_A.get_cap (ab, ba) \<lbrace>\<lambda>rv' a. same_object_as aa rv' \<longrightarrow> valid_idle a \<and> not_idle_thread (fst a') a \<and> valid_etcbs a \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> valid_global_refs a \<and> valid_idle a \<and> valid_irq_node a \<and> valid_mdb a \<and> valid_objs a \<and> not_idle_thread ab a \<and> valid_etcbs a\<rbrace>
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q217 a aa ab ba ac bb (transform s') s' ()\<rbrace> corrupt_tcb_intent obj_id' \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q232 a aa ab ba ac bb s' b\<rbrace>
 3. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>b. valid_idle and not_idle_thread (fst (ab, ba)) and valid_etcbs and ?Q'230 a aa ab ba ac bb s' b\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>b. (\<lambda>_. True) and ?Q217 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 7. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_idle s \<and> not_idle_thread (fst (ab, ba)) s \<and> valid_etcbs s \<and> valid_idle s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> valid_etcbs s\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'216 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_global_refs s \<and> valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and ?Q'216 a aa ab ba ac bb s s' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>a aa ab ba ac bb s' tcb. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<forall>(getF, v)\<in>ran tcb_cap_cases. getF (tcb\<lparr>tcb_ipc_buffer := a\<rparr>) = getF tcb
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'726 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> ?P'726 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'726 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_idle s \<and> valid_irq_node s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> ?P'726 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>a aa ab ba ac bb s' t getF v. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; (getF, v) \<in> ran tcb_cap_cases\<rbrakk> \<Longrightarrow> getF (t\<lparr>tcb_ipc_buffer := a\<rparr>) = getF t
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'736 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> (not_idle_thread obj_id' and valid_idle) c \<and> valid_irq_node c \<and> ?P'736 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'736 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_mdb s \<and> valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> (not_idle_thread obj_id' and valid_idle) c \<and> valid_irq_node c \<and> ?P'736 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (6 subgoals):
 1. \<And>a aa ab ba ac bb s' t getF v. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'; (getF, v) \<in> ran tcb_cap_cases\<rbrakk> \<Longrightarrow> getF (t\<lparr>tcb_ipc_buffer := a\<rparr>) = getF t
 2. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'773 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> (not_idle_thread obj_id' and valid_idle) c \<and> valid_irq_node c \<and> valid_mdb c \<and> ?P'773 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 6. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; not_idle_thread obj_id' s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'773 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_objs s \<and> not_idle_thread ab s \<and> not_idle_thread (fst a') s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> (not_idle_thread obj_id' and valid_idle) c \<and> valid_irq_node c \<and> valid_mdb c \<and> ?P'773 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; obj_id' \<noteq> idle_thread s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; ab \<noteq> idle_thread s'; fst a' \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'773 a aa ab ba ac bb (transform s') s' ()\<rbrace> thread_set (tcb_ipc_buffer_update (\<lambda>_. a)) obj_id' \<lbrace>\<lambda>rv s. valid_objs s \<and> ab \<noteq> idle_thread s \<and> fst a' \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>c. valid_global_refs c \<and> (not_idle_thread obj_id' and valid_idle) c \<and> valid_irq_node c \<and> valid_mdb c \<and> ?P'773 a aa ab ba ac bb s s' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s' tcb. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; valid_etcbs s'; tcb_at obj_id' s'; obj_id' \<noteq> idle_thread s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; ab \<noteq> idle_thread s'; fst a' \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> \<forall>(getF, v)\<in>ran tcb_cap_cases. getF (tcb\<lparr>tcb_ipc_buffer := a\<rparr>) = getF tcb
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>b. valid_global_refs b \<and> (not_idle_thread obj_id' and valid_idle) b \<and> valid_irq_node b \<and> valid_mdb b \<and> (valid_objs and K (is_aligned a msg_align_bits)) b \<and> ab \<noteq> idle_thread b \<and> fst a' \<noteq> idle_thread b \<and> valid_etcbs b \<and> cte_wp_at (\<lambda>_. True) (ab, ba) b \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (4 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb s s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True \<and> True)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>b. valid_global_refs b \<and> (not_idle_thread obj_id' and valid_idle) b \<and> valid_irq_node b \<and> valid_mdb b \<and> (valid_objs and K (is_aligned a msg_align_bits)) b \<and> ab \<noteq> idle_thread b \<and> fst a' \<noteq> idle_thread b \<and> valid_etcbs b \<and> cte_wp_at (\<lambda>_. True) (ab, ba) b \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (4 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q185 a aa ab ba ac bb (transform s') s'\<rbrace> tcb_empty_thread_slot obj_id' tcb_ipcbuffer_slot \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>b. valid_global_refs b \<and> (not_idle_thread obj_id' and valid_idle) b \<and> valid_irq_node b \<and> valid_mdb b \<and> (valid_objs and K (is_aligned a msg_align_bits)) b \<and> ab \<noteq> idle_thread b \<and> fst a' \<noteq> idle_thread b \<and> valid_etcbs b \<and> cte_wp_at (\<lambda>_. True) (ab, ba) b \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s s' rv sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 2. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 3. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb s s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>b. tcb_at obj_id' and valid_idle and not_idle_thread obj_id' and valid_etcbs and (\<lambda>b. valid_global_refs b \<and> (not_idle_thread obj_id' and valid_idle) b \<and> valid_irq_node b \<and> valid_mdb b \<and> (valid_objs and K (is_aligned a msg_align_bits)) b \<and> ab \<noteq> idle_thread b \<and> fst a' \<noteq> idle_thread b \<and> valid_etcbs b \<and> cte_wp_at (\<lambda>_. True) (ab, ba) b \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) b)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (3 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb (transform s') s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>a b. tcb_at obj_id' b \<and> valid_idle b \<and> not_idle_thread obj_id' b \<and> valid_etcbs b \<and> valid_global_refs b \<and> not_idle_thread obj_id' b \<and> valid_idle b \<and> valid_irq_node b \<and> valid_mdb b \<and> valid_objs b \<and> ab \<noteq> idle_thread b \<and> fst a' \<noteq> idle_thread b \<and> valid_etcbs b \<and> cte_wp_at (\<lambda>_. True) (ab, ba) b \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb (transform s') s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>r s. invs s \<and> valid_etcbs s \<and> not_idle_thread (fst a') s \<and> tcb_at obj_id' s \<and> not_idle_thread obj_id' s \<and> not_idle_thread ab s \<and> cte_wp_at (\<lambda>a. True) (ab, ba) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) s \<and> is_aligned a msg_align_bits\<rbrace>, \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s s' rv sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; invs sa \<and> valid_etcbs sa \<and> not_idle_thread (fst a') sa \<and> tcb_at obj_id' sa \<and> not_idle_thread obj_id' sa \<and> not_idle_thread ab sa \<and> cte_wp_at (\<lambda>a. True) (ab, ba) sa \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) sa \<and> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> tcb_at obj_id' sa \<and> valid_idle sa \<and> not_idle_thread obj_id' sa \<and> valid_etcbs sa \<and> valid_global_refs sa \<and> not_idle_thread obj_id' sa \<and> valid_idle sa \<and> valid_irq_node sa \<and> valid_mdb sa \<and> valid_objs sa \<and> ab \<noteq> idle_thread sa \<and> fst a' \<noteq> idle_thread sa \<and> valid_etcbs sa \<and> cte_wp_at (\<lambda>_. True) (ab, ba) sa \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) sa
 3. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (5 subgoals):
 1. \<And>a aa ab ba ac bb s s'. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> obj_id' \<noteq> idle_thread s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> ab \<noteq> idle_thread s' \<and> fst a' \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'185 a aa ab ba ac bb (transform s') s'\<rbrace> cap_delete (obj_id', tcb_cnode_index 4) \<lbrace>\<lambda>r s. invs s \<and> valid_etcbs s \<and> fst a' \<noteq> idle_thread s \<and> tcb_at obj_id' s \<and> obj_id' \<noteq> idle_thread s \<and> ab \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>a. True) (ab, ba) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) s\<rbrace>, \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>a aa ab ba ac bb s s' rv sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; invs sa \<and> valid_etcbs sa \<and> not_idle_thread (fst a') sa \<and> tcb_at obj_id' sa \<and> not_idle_thread obj_id' sa \<and> not_idle_thread ab sa \<and> cte_wp_at (\<lambda>a. True) (ab, ba) sa \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) sa \<and> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> tcb_at obj_id' sa \<and> valid_idle sa \<and> not_idle_thread obj_id' sa \<and> valid_etcbs sa \<and> valid_global_refs sa \<and> not_idle_thread obj_id' sa \<and> valid_idle sa \<and> valid_irq_node sa \<and> valid_mdb sa \<and> valid_objs sa \<and> ab \<noteq> idle_thread sa \<and> fst a' \<noteq> idle_thread sa \<and> valid_etcbs sa \<and> cte_wp_at (\<lambda>_. True) (ab, ba) sa \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) sa
 3. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 5. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ?Q'185 a aa ab ba ac bb s s') sa proof (prove)
goal (4 subgoals):
 1. \<And>a aa ab ba ac bb s s' rv sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; invs sa \<and> valid_etcbs sa \<and> not_idle_thread (fst a') sa \<and> tcb_at obj_id' sa \<and> not_idle_thread obj_id' sa \<and> not_idle_thread ab sa \<and> cte_wp_at (\<lambda>a. True) (ab, ba) sa \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) sa \<and> is_aligned a msg_align_bits\<rbrakk> \<Longrightarrow> tcb_at obj_id' sa \<and> valid_idle sa \<and> not_idle_thread obj_id' sa \<and> valid_etcbs sa \<and> valid_global_refs sa \<and> not_idle_thread obj_id' sa \<and> valid_idle sa \<and> valid_irq_node sa \<and> valid_mdb sa \<and> valid_objs sa \<and> ab \<noteq> idle_thread sa \<and> fst a' \<noteq> idle_thread sa \<and> valid_etcbs sa \<and> cte_wp_at (\<lambda>_. True) (ab, ba) sa \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) sa
 2. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) a \<and> valid_etcbs a \<and> fst a' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> obj_id' \<noteq> idle_thread a \<and> ab \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>a aa ab ba ac bb s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs s'; invs sa; valid_etcbs s'; valid_etcbs sa; tcb_at obj_id' s'; not_idle_thread (fst a') sa; not_idle_thread obj_id' s'; tcb_at obj_id' sa; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; not_idle_thread obj_id' sa; valid_ipc_buffer_cap aa a; not_idle_thread ab sa; is_arch_cap aa; cte_wp_at (\<lambda>a. True) (ab, ba) sa; cap_aligned aa; cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) sa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; not_idle_thread ab s'; not_idle_thread (fst a') s'\<rbrakk> \<Longrightarrow> valid_global_refs sa \<and> valid_irq_node sa \<and> ab \<noteq> idle_thread sa \<and> fst a' \<noteq> idle_thread sa \<and> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) sa
 2. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) a \<and> valid_etcbs a \<and> fst a' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> obj_id' \<noteq> idle_thread a \<and> ab \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> True)) sa proof (prove)
goal (4 subgoals):
 1. \<And>a aa ab ba ac bb s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); valid_etcbs s'; valid_etcbs sa; tcb_at obj_id' s'; fst a' \<noteq> idle_thread sa; obj_id' \<noteq> idle_thread s'; tcb_at obj_id' sa; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; obj_id' \<noteq> idle_thread sa; valid_ipc_buffer_cap aa a; ab \<noteq> idle_thread sa; is_arch_cap aa; cte_wp_at (\<lambda>a. True) (ab, ba) sa; cap_aligned aa; cte_wp_at (\<lambda>c. c = cap.NullCap) (obj_id', tcb_cnode_index 4) sa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) s'; ab \<noteq> idle_thread s'; fst a' \<noteq> idle_thread s'; valid_pspace s'; valid_pspace sa; valid_mdb s'; valid_mdb sa; valid_ioc s'; valid_ioc sa; valid_idle s'; valid_idle sa; only_idle s'; only_idle sa; if_unsafe_then_cap s'; if_unsafe_then_cap sa; valid_reply_caps s'; valid_reply_caps sa; valid_reply_masters s'; valid_reply_masters sa; valid_global_refs s'; valid_global_refs sa; valid_arch_state s'; valid_arch_state sa; valid_irq_node s'; valid_irq_node sa; valid_irq_handlers s'; valid_irq_handlers sa; valid_irq_states s'; valid_irq_states sa; valid_machine_state s'; valid_machine_state sa; valid_vspace_objs s'; valid_vspace_objs sa; valid_arch_caps s'; valid_arch_caps sa; valid_global_objs s'; valid_global_objs sa; valid_kernel_mappings s'; valid_kernel_mappings sa; equal_kernel_mappings s'; equal_kernel_mappings sa; valid_asid_map s'; valid_asid_map sa; valid_global_vspace_mappings s'; valid_global_vspace_mappings sa; pspace_in_kernel_window s'; pspace_in_kernel_window sa; cap_refs_in_kernel_window s'; cap_refs_in_kernel_window sa; pspace_respects_device_region s'; pspace_respects_device_region sa; cap_refs_respects_device_region s'; cur_tcb s'; cap_refs_respects_device_region sa; cur_tcb sa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) cap.NullCap) (obj_id', tcb_cnode_index 4) sa
 2. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 4. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) a \<and> valid_etcbs a \<and> fst a' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> obj_id' \<noteq> idle_thread a \<and> ab \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> True)) sa proof (prove)
goal (3 subgoals):
 1. \<And>a aa ab ba ac bb s s' e sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; invs s' \<and> valid_etcbs s' \<and> tcb_at obj_id' s' \<and> not_idle_thread obj_id' s' \<and> (\<forall>x\<in>ran (kheap s'). obj_valid_pdpt x) \<and> valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits \<and> cte_wp_at (\<lambda>_. True) (ab, ba) s' \<and> not_idle_thread ab s' \<and> not_idle_thread (fst a') s'; True\<rbrakk> \<Longrightarrow> True
 2. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 3. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) a \<and> valid_etcbs a \<and> fst a' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> obj_id' \<noteq> idle_thread a \<and> ab \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> True)) sa proof (prove)
goal (2 subgoals):
 1. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q185 a aa ab ba ac bb s s') sa
 2. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) a \<and> valid_etcbs a \<and> fst a' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> obj_id' \<noteq> idle_thread a \<and> ab \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb s s' sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); s = transform s'; True; (invs and valid_etcbs and tcb_at obj_id' and not_idle_thread obj_id' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and (\<lambda>y. valid_ipc_buffer_cap aa a \<and> is_arch_cap aa \<and> cap_aligned aa \<and> is_aligned a msg_align_bits) and cte_wp_at (\<lambda>_. True) (ab, ba) and not_idle_thread ab and not_idle_thread (fst a')) s'; s' = sa\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) and invs and emptyable (obj_id', tcb_cnode_index 4) and not_idle_thread (fst (obj_id', tcb_cnode_index 4)) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and (\<lambda>a. True \<and> (invs and emptyable (obj_id', tcb_cnode_index 4)) a \<and> valid_etcbs a \<and> fst a' \<noteq> idle_thread a \<and> tcb_at obj_id' a \<and> obj_id' \<noteq> idle_thread a \<and> ab \<noteq> idle_thread a \<and> cte_wp_at (\<lambda>_. True) (ab, ba) a \<and> True)) sa proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab ba ac bb sa. \<lbrakk>ipc_buffer' = Some (a, Some (aa, ab, ba)); (ac, bb) = transform_cslot_ptr (ab, ba); invs sa; valid_etcbs sa; tcb_at obj_id' sa; obj_id' \<noteq> idle_thread sa; \<forall>x\<in>ran (kheap sa). obj_valid_pdpt x; valid_ipc_buffer_cap aa a; is_arch_cap aa; cap_aligned aa; is_aligned a msg_align_bits; cte_wp_at (\<lambda>_. True) (ab, ba) sa; ab \<noteq> idle_thread sa; fst a' \<noteq> idle_thread sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (obj_id', tcb_cnode_index 4) sa proof (prove)
goal:
No subgoals!