theory Syscall_R

lemma decodeInvocation_corres:
  "\<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi;
    slot' = cte_map slot; cap_relation cap cap';
    args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps');
    list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps' \<rbrakk>
    \<Longrightarrow>
    corres (ser \<oplus> inv_relation)
           (invs and valid_sched and valid_list
                 and valid_cap cap and cte_at slot and cte_wp_at ((=) cap) slot
                 and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_at (snd x) s)
                 and (\<lambda>s. length args < 2 ^ word_bits))
           (invs' and valid_cap' cap' and cte_at' slot'
            and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile>' fst x \<and> cte_at' (snd x) s)
            and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)))
      (decode_invocation (mi_label mi) args cptr slot cap excaps)
      (RetypeDecls_H.decodeInvocation (mi_label mi) args' cptr' slot' cap' excaps')" apply (rule corres_gen_asm) apply (unfold decode_invocation_def decodeInvocation_def) apply (case_tac cap, simp_all only: cap.simps)
   \<comment> \<open>dammit, simp_all messes things up, must handle cases manually\<close>
             \<comment> \<open>Null\<close> apply (simp add: isCap_defs)
            \<comment> \<open>Untyped\<close> apply (simp add: isCap_defs Let_def o_def split del: if_split) apply (rule corres_guard_imp, rule decodeUntypedInvocation_corres) apply ((clarsimp simp:cte_wp_at_caps_of_state)+)[3]
           \<comment> \<open>(Async)Endpoint\<close> apply (simp add: isCap_defs returnOk_def) apply (simp add: isCap_defs) apply (clarsimp simp: returnOk_def neq_Nil_conv)
         \<comment> \<open>ReplyCap\<close> apply (simp add: isCap_defs Let_def returnOk_def)
        \<comment> \<open>CNodeCap\<close> apply (rename_tac word nat list) apply (simp add: isCap_defs Let_def CanModify_def
                    split del: if_split cong: if_cong) apply (clarsimp simp add: o_def) apply (rule corres_guard_imp) apply (rule_tac F="length list \<le> 32" in corres_gen_asm) apply (rule decodeCNodeInvocation_corres, simp+) apply (simp add: valid_cap_def word_bits_def) apply simp
       \<comment> \<open>ThreadCap\<close> apply (simp add: isCap_defs Let_def CanModify_def
                   split del: if_split cong: if_cong) apply (clarsimp simp add: o_def) apply (rule corres_guard_imp) apply (rule decodeTCBInvocation_corres, rule refl,
                simp_all add: valid_cap_def valid_cap'_def)[3] apply (simp add: split_def) apply (rule list_all2_conj) apply (simp add: list_all2_map2 list_all2_map1) apply assumption
      \<comment> \<open>DomainCap\<close> apply (simp add: isCap_defs) apply (rule corres_guard_imp) apply (rule decodeDomainInvocation_corres) apply (simp+)[4]
     \<comment> \<open>IRQControl\<close> apply (simp add: isCap_defs o_def) apply (rule corres_guard_imp, rule decodeIRQControlInvocation_corres, simp+)[1]
    \<comment> \<open>IRQHandler\<close> apply (simp add: isCap_defs o_def) apply (rule corres_guard_imp, rule decodeIRQHandlerInvocation_corres, simp+)[1]
   \<comment> \<open>Zombie\<close> apply (simp add: isCap_defs)
  \<comment> \<open>Arch\<close> apply (clarsimp simp only: cap_relation.simps) apply (clarsimp simp add: isCap_defs Let_def o_def) apply (rule corres_guard_imp [OF arch_decodeInvocation_corres]) apply (simp_all add: list_all2_map2 list_all2_map1)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s) and (\<lambda>s. length args < 2 ^ word_bits)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) slot' and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_invocation (mi_label mi) args cptr slot cap excaps) (global.decodeInvocation (mi_label mi) args' cptr' slot' cap' excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args < 2 ^ word_bits\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) slot' and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_invocation (mi_label mi) args cptr slot cap excaps) (global.decodeInvocation (mi_label mi) args' cptr' slot' cap' excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args < 2 ^ word_bits\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) slot' and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case cap of cap.UntypedCap dev ptr sz fi \<Rightarrow> liftME Invocations_A.invocation.InvokeUntyped $ decode_untyped_invocation (mi_label mi) args slot cap (map fst excaps) | cap.EndpointCap ptr badge rights \<Rightarrow> if AllowSend \<in> rights then returnOk $ Invocations_A.invocation.InvokeEndpoint ptr badge (AllowGrant \<in> rights) (AllowGrantReply \<in> rights) else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | cap.NotificationCap ptr badge rights \<Rightarrow> if AllowSend \<in> rights then returnOk $ Invocations_A.invocation.InvokeNotification ptr badge else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | cap.ReplyCap thread True rights \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | cap.ReplyCap thread False rights \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply thread slot (AllowGrant \<in> rights) | cap.CNodeCap ptr bits x \<Rightarrow> liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args cap (map fst excaps) | cap.ThreadCap ptr \<Rightarrow> liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args cap slot excaps | cap.DomainCap \<Rightarrow> liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args excaps | cap.IRQControlCap \<Rightarrow> liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args slot (map fst excaps) | cap.IRQHandlerCap irq \<Rightarrow> liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) irq excaps | cap.ArchObjectCap arch_cap \<Rightarrow> liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args cptr slot arch_cap excaps | _ \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) slot' (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap slot' excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' slot' cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' slot' $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' slot' cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (12 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.NullCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NullCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.NullCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.NullCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x21 x22 x23 x24. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.UntypedCap x21 x22 x23 x24) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.UntypedCap x21 x22 x23 x24) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.UntypedCap x21 x22 x23 x24)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeUntyped $ decode_untyped_invocation (mi_label mi) args' slot (cap.UntypedCap x21 x22 x23 x24) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x31 x32 x33. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.EndpointCap x31 x32 x33) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.EndpointCap x31 x32 x33) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x33 then returnOk $ Invocations_A.invocation.InvokeEndpoint x31 x32 (AllowGrant \<in> x33) (AllowGrantReply \<in> x33) else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.NotificationCap x41 x42 x43) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x43 then returnOk $ Invocations_A.invocation.InvokeNotification x41 x42 else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 10. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x22 x23 x24. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.UntypedCap x21 x22 x23 x24) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.UntypedCap x21 x22 x23 x24) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.UntypedCap x21 x22 x23 x24)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeUntyped $ decode_untyped_invocation (mi_label mi) args' slot (cap.UntypedCap x21 x22 x23 x24) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x31 x32 x33. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.EndpointCap x31 x32 x33) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.EndpointCap x31 x32 x33) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x33 then returnOk $ Invocations_A.invocation.InvokeEndpoint x31 x32 (AllowGrant \<in> x33) (AllowGrantReply \<in> x33) else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.NotificationCap x41 x42 x43) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x43 then returnOk $ Invocations_A.invocation.InvokeNotification x41 x42 else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 10. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x22 x23 x24. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.UntypedCap x21 x22 x23 x24; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> corres (ser \<oplus> untypinv_relation) (invs and valid_sched and valid_list and valid_cap (cap.UntypedCap x21 x22 x23 x24) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.UntypedCap x21 x22 x23 x24)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.UntypedCap x21 x22 x23 x24) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_untyped_invocation (mi_label mi) args' slot (cap.UntypedCap x21 x22 x23 x24) (map fst excaps)) (decodeUntypedInvocation (mi_label mi) args' (cte_map slot) (capability.UntypedCap x21 x22 x23 x24) (map fst excaps'))
 2. \<And>x31 x32 x33. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.EndpointCap x31 x32 x33) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.EndpointCap x31 x32 x33) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x33 then returnOk $ Invocations_A.invocation.InvokeEndpoint x31 x32 (AllowGrant \<in> x33) (AllowGrantReply \<in> x33) else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.NotificationCap x41 x42 x43) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x43 then returnOk $ Invocations_A.invocation.InvokeNotification x41 x42 else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 10. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x21 x22 x23 x24. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.UntypedCap x21 x22 x23 x24; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.UntypedCap x21 x22 x23 x24\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map fst excaps) (map fst excaps')
 2. \<And>x21 x22 x23 x24 s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.UntypedCap x21 x22 x23 x24; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.UntypedCap x21 x22 x23 x24; (invs and valid_sched and valid_list and valid_cap (cap.UntypedCap x21 x22 x23 x24) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.UntypedCap x21 x22 x23 x24)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invs and cte_wp_at ((=) (cap.UntypedCap x21 x22 x23 x24)) slot and (\<lambda>s. \<forall>x\<in>set (map fst excaps). s \<turnstile> x)) s
 3. \<And>x21 x22 x23 x24 s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.UntypedCap x21 x22 x23 x24; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.UntypedCap x21 x22 x23 x24; (invs' and valid_cap' (capability.UntypedCap x21 x22 x23 x24) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (invs' and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). valid_cap' x s)) s
 4. \<And>x31 x32 x33. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.EndpointCap x31 x32 x33) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.EndpointCap x31 x32 x33) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x33 then returnOk $ Invocations_A.invocation.InvokeEndpoint x31 x32 (AllowGrant \<in> x33) (AllowGrantReply \<in> x33) else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.NotificationCap x41 x42 x43) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x43 then returnOk $ Invocations_A.invocation.InvokeNotification x41 x42 else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
A total of 13 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x31 x32 x33. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.EndpointCap x31 x32 x33) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.EndpointCap x31 x32 x33\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.EndpointCap x31 x32 x33) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.EndpointCap x31 x32 x33)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x33 then returnOk $ Invocations_A.invocation.InvokeEndpoint x31 x32 (AllowGrant \<in> x33) (AllowGrantReply \<in> x33) else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.NotificationCap x41 x42 x43) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x43 then returnOk $ Invocations_A.invocation.InvokeNotification x41 x42 else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 10. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (9 subgoals):
 1. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.NotificationCap x41 x42 x43) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (if AllowSend \<in> x43 then returnOk $ Invocations_A.invocation.InvokeNotification x41 x42 else throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (9 subgoals):
 1. \<And>x41 x42 x43. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.NotificationCap x41 x42 (AllowWrite \<in> x43) (AllowRead \<in> x43); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.NotificationCap x41 x42 x43\<rbrakk> \<Longrightarrow> AllowWrite \<in> x43 \<longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.NotificationCap x41 x42 x43) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.NotificationCap x41 x42 x43)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.NotificationCap x41 x42 True (AllowRead \<in> x43)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (returnOk (Invocations_A.invocation.InvokeNotification x41 x42)) (returnOk (Invocations_H.invocation.InvokeNotification x41 x42))
 2. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (8 subgoals):
 1. \<And>x51 x52 x53. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ReplyCap x51 x52 x53) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ReplyCap x51 x52 x53\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ReplyCap x51 x52 x53) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ReplyCap x51 x52 x53)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (case x52 of True \<Rightarrow> throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0 | False \<Rightarrow> returnOk $ Invocations_A.invocation.InvokeReply x51 slot (AllowGrant \<in> x53)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<And>x61 x62 x63. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap x61 x62 x63) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap x61 x62 x63\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap x61 x62 x63) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap x61 x62 x63)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap x61 x62 x63) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<And>word nat list. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.CNodeCap word nat list) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap word nat list) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap word nat list)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeCNode $ decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap word nat list) (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<And>word nat list. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ((\<lambda>x. inv_relation x \<circ> Invocations_H.invocation.InvokeCNode) \<circ> Invocations_A.invocation.InvokeCNode)) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap word nat list) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap word nat list)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap word nat list) (map fst excaps)) (decodeCNodeInvocation (mi_label mi) args' (capability.CNodeCap word nat (of_bl list) (length list)) (map fst excaps'))
 2. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<And>word nat list. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cnodeinv_relation) (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap word nat list) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap word nat list)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap word nat list) (map fst excaps)) (decodeCNodeInvocation (mi_label mi) args' (capability.CNodeCap word nat (of_bl list) (length list)) (map fst excaps'))
 2. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (9 subgoals):
 1. \<And>word nat list. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cnodeinv_relation) (?Q49 word nat list) (?Q'49 word nat list) (decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap word nat list) (map fst excaps)) (decodeCNodeInvocation (mi_label mi) args' (capability.CNodeCap word nat (of_bl list) (length list)) (map fst excaps'))
 2. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap word nat list) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap word nat list)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?Q49 word nat list s
 3. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?Q'49 word nat list s
 4. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (9 subgoals):
 1. \<And>word nat list. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; length list \<le> 32\<rbrakk> \<Longrightarrow> corres (ser \<oplus> cnodeinv_relation) (?P53 word nat list) (?Q'49 word nat list) (decode_cnode_invocation (mi_label mi) args' (cap.CNodeCap word nat list) (map fst excaps)) (decodeCNodeInvocation (mi_label mi) args' (capability.CNodeCap word nat (of_bl list) (length list)) (map fst excaps'))
 2. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; (invs and valid_sched and valid_list and valid_cap (cap.CNodeCap word nat list) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.CNodeCap word nat list)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> (?P53 word nat list and (\<lambda>s. length list \<le> 32)) s
 3. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?Q'49 word nat list s
 4. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 9. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (8 subgoals):
 1. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; invs s \<and> valid_sched s \<and> valid_list s \<and> s \<turnstile> cap.CNodeCap word nat list \<and> cte_wp_at (\<lambda>_. True) slot s \<and> cte_wp_at ((=) (cap.CNodeCap word nat list)) slot s \<and> (\<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)\<rbrakk> \<Longrightarrow> cap_table_at nat word s \<and> 0 < nat \<and> length list \<le> 32
 2. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). valid_cap' x s)) s
 3. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<And>word nat list s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.CNodeCap word nat (of_bl list) (length list); args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.CNodeCap word nat list; (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (invs' and valid_cap' (capability.CNodeCap word nat (of_bl list) (length list)) and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). valid_cap' x s)) s
 2. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ThreadCap x7) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeTCB $ decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ((\<lambda>x. inv_relation x \<circ> Invocations_H.invocation.InvokeTCB) \<circ> Invocations_A.invocation.InvokeTCB)) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.ThreadCap x7) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (decodeTCBInvocation (mi_label mi) args' (capability.ThreadCap x7) (cte_map slot) excaps')
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.ThreadCap x7) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (decodeTCBInvocation (mi_label mi) args' (capability.ThreadCap x7) (cte_map slot) excaps')
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (8 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> corres (ser \<oplus> tcbinv_relation) (?Q60 x7) (?Q'60 x7) (decode_tcb_invocation (mi_label mi) args' (cap.ThreadCap x7) slot excaps) (decodeTCBInvocation (mi_label mi) args' (capability.ThreadCap x7) (cte_map slot) excaps')
 2. \<And>x7 s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7; (invs and valid_sched and valid_list and valid_cap (cap.ThreadCap x7) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ThreadCap x7)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?Q60 x7 s
 3. \<And>x7 s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7; (invs' and valid_cap' (capability.ThreadCap x7) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?Q'60 x7 s
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>(c, sl) (c', sl'). cap_relation c c' \<and> sl' = cte_map sl) excaps excaps'
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>p pa. cap_relation (fst p) (fst pa) \<and> snd pa = cte_map (snd p)) excaps excaps'
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>a b. cap_relation (fst a) (fst b)) excaps excaps'
 2. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>a b. snd b = cte_map (snd a)) excaps excaps'
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (6 subgoals):
 1. \<And>x7. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.ThreadCap x7; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ThreadCap x7\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>a b. snd b = cte_map (snd a)) excaps excaps'
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.DomainCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y) $ decode_domain_invocation (mi_label mi) args' excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ((\<lambda>x. inv_relation x \<circ> uncurry Invocations_H.invocation.InvokeDomain) \<circ> (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y))) (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' capability.DomainCap and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_domain_invocation (mi_label mi) args' excaps) (decodeDomainInvocation (mi_label mi) args' excaps')
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ((\<lambda>x. inv_relation x \<circ> uncurry Invocations_H.invocation.InvokeDomain) \<circ> (\<lambda>(x, y). Invocations_A.invocation.InvokeDomain x y))) ?Q75 ?Q'75 (decode_domain_invocation (mi_label mi) args' excaps) (decodeDomainInvocation (mi_label mi) args' excaps')
 2. \<And>s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap; (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?Q75 s
 3. \<And>s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap; (invs' and valid_cap' capability.DomainCap and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?Q'75 s
 4. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 5. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map fst excaps) (map fst excaps')
 2. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'
 3. \<And>s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap; (invs and valid_sched and valid_list and valid_cap cap.DomainCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.DomainCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> True
 4. \<And>s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.DomainCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.DomainCap; (invs' and valid_cap' capability.DomainCap and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> True
 5. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 6. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 7. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 8. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation cap.IRQControlCap cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQControl $ decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.IRQControlCap; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQControlCap\<rbrakk> \<Longrightarrow> corres (ser \<oplus> irq_control_inv_relation) (invs and valid_sched and valid_list and valid_cap cap.IRQControlCap and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) cap.IRQControlCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' capability.IRQControlCap and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_irq_control_invocation (mi_label mi) args' slot (map fst excaps)) (global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) (map fst excaps'))
 2. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 4. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (3 subgoals):
 1. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.IRQHandlerCap x10) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeIRQHandler $ decode_irq_handler_invocation (mi_label mi) x10 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (3 subgoals):
 1. \<And>x10. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap' = capability.IRQHandlerCap x10; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.IRQHandlerCap x10\<rbrakk> \<Longrightarrow> corres (ser \<oplus> irq_handler_inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.IRQHandlerCap x10) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.IRQHandlerCap x10)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.IRQHandlerCap x10) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (decode_irq_handler_invocation (mi_label mi) x10 excaps) (decodeIRQHandlerInvocation (mi_label mi) x10 excaps')
 2. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 3. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (2 subgoals):
 1. \<And>x111 x112 x113. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.Zombie x111 x112 x113) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.Zombie x111 x112 x113\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.Zombie x111 x112 x113) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.Zombie x111 x112 x113)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (throwError $ ExceptionTypes_A.syscall_error.InvalidCapability 0) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0)
 2. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (1 subgoal):
 1. \<And>x12. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; cap_relation (cap.ArchObjectCap x12) cap'; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' cap' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = cap' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (1 subgoal):
 1. \<And>x12 a'. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> inv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.ArchObjectCap a') and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (liftME Invocations_A.invocation.InvokeArchObject $ arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (let cap = capability.ArchObjectCap a' in if isEndpointCap cap \<and> capEPCanSend cap then returnOk $ Invocations_H.invocation.InvokeEndpoint (capEPPtr cap) (capEPBadge cap) (capEPCanGrant cap) (capEPCanGrantReply cap) else if isNotificationCap cap \<and> capNtfnCanSend cap then returnOk $ Invocations_H.invocation.InvokeNotification (capNtfnPtr cap) (capNtfnBadge cap) else if isReplyCap cap \<and> \<not> capReplyMaster cap then returnOk $ Invocations_H.invocation.InvokeReply (capTCBPtr cap) (cte_map slot) (capReplyCanGrant cap) else if isThreadCap cap then liftME Invocations_H.invocation.InvokeTCB $ decodeTCBInvocation (mi_label mi) args' cap (cte_map slot) excaps' else if isDomainCap cap then liftME (uncurry Invocations_H.invocation.InvokeDomain) $ decodeDomainInvocation (mi_label mi) args' excaps' else if isCNodeCap cap then liftME Invocations_H.invocation.InvokeCNode $ decodeCNodeInvocation (mi_label mi) args' cap $ map fst excaps' else if isUntypedCap cap then liftME Invocations_H.invocation.InvokeUntyped $ decodeUntypedInvocation (mi_label mi) args' (cte_map slot) cap $ map fst excaps' else if isIRQControlCap cap then liftME Invocations_H.invocation.InvokeIRQControl $ global.decodeIRQControlInvocation (mi_label mi) args' (cte_map slot) $ map fst excaps' else if isIRQHandlerCap cap then let irq = capIRQ cap in liftME Invocations_H.invocation.InvokeIRQHandler $ decodeIRQHandlerInvocation (mi_label mi) irq excaps' else if isArchObjectCap cap then let cap = capCap cap in liftME Invocations_H.invocation.InvokeArchObject $ Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) cap excaps' else throw $ Fault_H.syscall_error.InvalidCapability 0) proof (prove)
goal (1 subgoal):
 1. \<And>x12 a'. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> archinv_relation) (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) (invs' and valid_cap' (capability.ArchObjectCap a') and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) (arch_decode_invocation (mi_label mi) args' (to_bl cptr') slot x12 excaps) (Arch.decodeInvocation (mi_label mi) args' cptr' (cte_map slot) a' excaps') proof (prove)
goal (5 subgoals):
 1. \<And>x12 a'. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'\<rbrakk> \<Longrightarrow> acap_relation x12 a'
 2. \<And>x12 a'. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map fst excaps) (map fst excaps')
 3. \<And>x12 a'. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>s s'. s' = cte_map s) (map snd excaps) (map snd excaps')
 4. \<And>x12 a' s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'; (invs and valid_sched and valid_list and valid_cap (cap.ArchObjectCap x12) and cte_wp_at (\<lambda>_. True) slot and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invs and valid_cap (cap.ArchObjectCap x12) and cte_wp_at ((=) (cap.ArchObjectCap x12)) slot and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s
 5. \<And>x12 a' s. \<lbrakk>cptr = to_bl cptr'; mi' = message_info_map mi; slot' = cte_map slot; args = args'; list_all2 cap_relation (map fst excaps) (map fst excaps'); list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) excaps excaps'; length args' < 2 ^ word_bits; cap = cap.ArchObjectCap x12; acap_relation x12 a'; cap' = capability.ArchObjectCap a'; (invs' and valid_cap' (capability.ArchObjectCap a') and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (invs' and valid_cap' (capability.ArchObjectCap a') and (\<lambda>s. \<forall>x\<in>set excaps'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s proof (prove)
goal:
No subgoals!