theory Intent_DR

lemma store_word_corres_helper:
  "\<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s;
    ipc_frame_sz_at sz s_id s; is_aligned ptr 2 ; within_page buf ptr sz\<rbrakk>
            \<Longrightarrow> \<exists>f. corrupt_intents (f) buf (transform s) =
               transform (update_machine (storeWord_ms ptr b (machine_state s)) s)" unfolding transform_def corrupt_intents_def supply option.case_cong[cong] apply (clarsimp simp: transform_current_thread_def transform_objects_def Let_def) apply (rule exI) apply (rule ext) apply (rename_tac thread) apply (clarsimp simp: map_add_def split: option.splits simp del: Option.case_map_option) apply (rule conjI) apply (clarsimp simp:restrict_map_def map_add_def) apply clarsimp apply (rule conjI) apply (clarsimp simp:restrict_map_def transform_object_def transform_tcb_def
                   split:cdl_object.split_asm Structures_A.kernel_object.split_asm if_split_asm) apply (drule(1) valid_etcbs_tcb_etcb,
                   clarsimp simp:restrict_map_def transform_object_def transform_tcb_def
                            split:cdl_object.split_asm Structures_A.kernel_object.split_asm if_split_asm)+ defer apply (drule(1) valid_etcbs_tcb_etcb,
                 clarsimp simp:restrict_map_def transform_object_def transform_tcb_def
                          split:cdl_object.split_asm Structures_A.kernel_object.split_asm if_split_asm)+ defer apply (simp add:tcb_ipcframe_id_def tcb_boundntfn_slot_def tcb_ipcbuffer_slot_def split:if_split_asm) apply (simp add:tcb_ipcbuffer_slot_def tcb_pending_op_slot_def) apply (frule_tac thread = thread in valid_tcb_objs) apply (simp add: get_tcb_rev) apply (clarsimp simp:valid_tcb_def tcb_cap_cases_def) apply (rename_tac tcb etcb) apply (case_tac "\<not> is_arch_page_cap (tcb_ipcframe tcb)") apply (simp add:transform_full_intent_no_ipc_buffer) apply (clarsimp simp del:upt.simps simp:transform_full_intent_def Let_def get_tcb_mrs_def is_arch_page_cap_def
                   split:cap.split_asm arch_cap.split_asm split del:if_split) apply (rename_tac word cap_rights vmpage_size option) apply (clarsimp simp:transform_cap_def arch_cap.split_asm simp del:upt.simps) apply (frule_tac thread = thread and ptr = ptr and sz = sz
            and ms = "machine_state s" and tcb_type = tcb and b = b and s_id = s_id
            and xs = "[Suc (length msg_registers)..<Suc msg_max_length]"
            in get_ipc_buffer_words_separate_frame) apply (erule get_tcb_rev) apply ((simp add:ipc_frame_wp_at_def obj_at_def)+)[8] apply (clarsimp simp del:upt.simps) apply (rule_tac y = thread in within_page_ipc_buf) apply (simp add:ipc_frame_wp_at_def obj_at_def ipc_buffer_wp_at_def)+ apply (simp add:msg_max_length_def msg_align_bits) apply simp apply (clarsimp simp:transform_cap_def split:cap.splits arch_cap.splits) apply (rule conjI) apply (frule_tac thread = thread and ptr = ptr and sz = sz and ms = "machine_state s" and
            tcb_type = tcb and b = b and s_id = s_id
            and xs = "[buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]"
            in get_ipc_buffer_words_separate_frame) apply (erule get_tcb_rev) apply ((simp add:ipc_frame_wp_at_def obj_at_def)+)[8] apply (clarsimp simp del:upt.simps) apply (rule_tac sz = vmpage_size and y = thread in within_page_ipc_buf) apply (simp add:ipc_frame_wp_at_def obj_at_def ipc_buffer_wp_at_def)+ apply (simp add:msg_max_length_def msg_align_bits buffer_cptr_index_def) apply (case_tac "get_tcb_message_info tcb") apply (clarsimp simp add: get_tcb_message_info_def data_to_message_info_def) apply (erule order_less_le_trans) apply (simp add: mask_def) apply (rule iffD1[OF word_le_nat_alt[where b = "0x6::word32",simplified]]) apply (rule order_trans) apply (rule  word_and_le1[where a = 3]) apply ((clarsimp simp:ipc_frame_wp_at_def obj_at_def)+)[4] apply (frule_tac thread = thread and ptr = ptr and sz = sz and ms = "machine_state s" and
           tcb_type = tcb and b = b and s_id = s_id
           and xs = "[Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]"
           in get_ipc_buffer_words_separate_frame) apply (erule get_tcb_rev) apply ((simp add:ipc_frame_wp_at_def obj_at_def)+)[8] apply (clarsimp simp del:upt.simps) apply (rule_tac y = thread and sz = vmpage_size in within_page_ipc_buf) apply (simp add:ipc_frame_wp_at_def obj_at_def ipc_buffer_wp_at_def)+ apply (clarsimp simp:msg_align_bits msg_max_length_def msg_max_extra_caps_def) apply simp+ apply (clarsimp simp: tcb_ipcframe_id_def split: cdl_object.splits option.split_asm cdl_cap.split_asm) apply (clarsimp simp: transform_object_def split:Structures_A.kernel_object.split_asm arch_kernel_obj.split_asm nat.splits) apply (rename_tac tcb) apply (simp add:transform_tcb_def) apply (drule sym) apply (clarsimp simp:tcb_pending_op_slot_def restrict_map_def tcb_ipcbuffer_slot_def split:if_splits) apply (frule(1) valid_etcbs_tcb_etcb[OF _ eq_sym_helper]) apply clarsimp apply (subgoal_tac "(get_tcb thread s) = Some tcb") apply (clarsimp dest!:get_tcb_SomeD) apply (subgoal_tac "tcb = the (get_tcb thread s)") apply (subgoal_tac "etcb = the (get_etcb thread s)") apply simp apply (simp add: get_etcb_rev) apply (simp add:get_tcb_rev)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> \<exists>f. corrupt_intents f buf (transform s) = transform (update_machine (storeWord_ms ptr b (machine_state s)) s) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> \<exists>f. (let changed = \<lambda>ptr. case cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s, cdl_cdt = transform_cdt s, cdl_current_thread = transform_current_thread s, cdl_irq_node = interrupt_irq_node s, cdl_asid_table = transform_asid_table s, cdl_current_domain = transform_current_domain s\<rparr> ptr of None \<Rightarrow> None | Some (Tcb tcb) \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (f ptr) tcb)) else None | Some _ \<Rightarrow> None in \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s, cdl_cdt = transform_cdt s, cdl_current_thread = transform_current_thread s, cdl_irq_node = interrupt_irq_node s, cdl_asid_table = transform_asid_table s, cdl_current_domain = transform_current_domain s\<rparr>\<lparr>cdl_objects := cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s, cdl_cdt = transform_cdt s, cdl_current_thread = transform_current_thread s, cdl_irq_node = interrupt_irq_node s, cdl_asid_table = transform_asid_table s, cdl_current_domain = transform_current_domain s\<rparr> ++ changed\<rparr>) = \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_cdt = transform_cdt (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_current_thread = transform_current_thread (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_irq_node = interrupt_irq_node (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_asid_table = transform_asid_table (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_current_domain = transform_current_domain (update_machine (storeWord_ms ptr b (machine_state s)) s)\<rparr> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> \<exists>f. (let changed = \<lambda>ptr. case cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s, cdl_cdt = transform_cdt s, cdl_current_thread = transform_current_thread s, cdl_irq_node = interrupt_irq_node s, cdl_asid_table = transform_asid_table s, cdl_current_domain = transform_current_domain s\<rparr> ptr of None \<Rightarrow> None | Some (Tcb tcb) \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (f ptr) tcb)) else None | Some _ \<Rightarrow> None in \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s, cdl_cdt = transform_cdt s, cdl_current_thread = transform_current_thread s, cdl_irq_node = interrupt_irq_node s, cdl_asid_table = transform_asid_table s, cdl_current_domain = transform_current_domain s\<rparr>\<lparr>cdl_objects := cdl_objects \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s, cdl_cdt = transform_cdt s, cdl_current_thread = transform_current_thread s, cdl_irq_node = interrupt_irq_node s, cdl_asid_table = transform_asid_table s, cdl_current_domain = transform_current_domain s\<rparr> ++ changed\<rparr>) = \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_cdt = transform_cdt (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_current_thread = transform_current_thread (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_irq_node = interrupt_irq_node (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_asid_table = transform_asid_table (update_machine (storeWord_ms ptr b (machine_state s)) s), cdl_current_domain = transform_current_domain (update_machine (storeWord_ms ptr b (machine_state s)) s)\<rparr> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> \<exists>f. (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr)) ++ (\<lambda>ptr. case ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr))) ptr of None \<Rightarrow> None | Some (Tcb tcb) \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (f ptr) tcb)) else None | Some _ \<Rightarrow> None) = (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptra. map_option (transform_object (storeWord_ms ptr b (machine_state s)) ptra ((ekheap s |` (- {idle_thread s})) ptra)) ((kheap s |` (- {idle_thread s})) ptra)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr)) ++ (\<lambda>ptr. case ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr))) ptr of None \<Rightarrow> None | Some (Tcb tcb) \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f14 ptr) tcb)) else None | Some _ \<Rightarrow> None) = (\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptra. map_option (transform_object (storeWord_ms ptr b (machine_state s)) ptra ((ekheap s |` (- {idle_thread s})) ptra)) ((kheap s |` (- {idle_thread s})) ptra)) proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr)) ++ (\<lambda>ptr. case ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr))) ptr of None \<Rightarrow> None | Some (Tcb tcb) \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f14 ptr) tcb)) else None | Some _ \<Rightarrow> None)) x = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptra. map_option (transform_object (storeWord_ms ptr b (machine_state s)) ptra ((ekheap s |` (- {idle_thread s})) ptra)) ((kheap s |` (- {idle_thread s})) ptra))) x proof (prove)
goal (1 subgoal):
 1. \<And>thread. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr)) ++ (\<lambda>ptr. case ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptr. map_option (transform_object (machine_state s) ptr ((ekheap s |` (- {idle_thread s})) ptr)) ((kheap s |` (- {idle_thread s})) ptr))) ptr of None \<Rightarrow> None | Some (Tcb tcb) \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f14 ptr) tcb)) else None | Some _ \<Rightarrow> None)) thread = ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s}) ++ (\<lambda>ptra. map_option (transform_object (storeWord_ms ptr b (machine_state s)) ptra ((ekheap s |` (- {idle_thread s})) ptra)) ((kheap s |` (- {idle_thread s})) ptra))) thread proof (prove)
goal (1 subgoal):
 1. \<And>thread. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2. ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2))) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> x2 = x2a)) \<and> (\<forall>x2. ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2)) \<and> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> ((case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2b. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2b = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2b. (case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2a = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)))))) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2. ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2)) \<and> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> ((case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2b. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2b = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2b. (case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2a = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2))))))) proof (prove)
goal (2 subgoals):
 1. \<And>thread. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> (kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2. ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2))
 2. \<And>thread. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> \<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> x2 = x2a)) \<and> (\<forall>x2. ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2)) \<and> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> ((case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2b. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2b = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2b. (case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2a = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)))))) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2. ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2)) \<and> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> ((case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2b. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2b = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2b. (case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2a = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)))))) proof (prove)
goal (1 subgoal):
 1. \<And>thread. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz\<rbrakk> \<Longrightarrow> \<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> x2 = x2a)) \<and> (\<forall>x2. ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2)) \<and> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> ((case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2b. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2b = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2b. (case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2a = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)))))) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2. ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> x2a = x2)) \<and> (\<forall>x2a. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2a) \<longrightarrow> ((case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2)) \<and> (\<forall>x2b. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2b = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2a = x2))) \<and> (\<forall>x2b. (case x2a of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2b \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> ((case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)) \<and> (\<forall>x2a. (case x2 of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((kheap s |` (- {idle_thread s})) thread = None \<longrightarrow> x2a = x2) \<and> (\<forall>x2. (\<exists>z. (kheap s |` (- {idle_thread s})) thread = Some z \<and> transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z = x2) \<longrightarrow> x2b = x2)))))) proof (prove)
goal (1 subgoal):
 1. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z))) \<and> (\<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z))) proof (prove)
goal (2 subgoals):
 1. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z))
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (11 subgoals):
 1. \<And>thread x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.Endpoint\<rbrakk> \<Longrightarrow> cdl_object.Endpoint = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>thread z x2 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.Notification\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.Notification = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>thread z x2 x3 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Tcb x3; tcb_ipcframe_id x3 \<noteq> Some buf\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> Tcb x3 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>thread z x2 x4 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.CNode x4 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>thread z x2 x5 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = AsidPool x5\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> AsidPool x5 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>thread z x2 x6 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.PageTable x6 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>thread z x2 x7 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.PageDirectory x7 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 8. \<And>thread z x2 x8 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Frame x8\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> Frame x8 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 9. \<And>thread z x2 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.Untyped\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.Untyped = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 10. \<And>thread z x2 x10 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = IRQNode x10\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> IRQNode x10 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_ipcframe_id \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> \<noteq> Some buf; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 2. \<And>thread z x2 x4 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.CNode x4 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>thread z x2 x5 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = AsidPool x5\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> AsidPool x5 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>thread z x2 x6 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.PageTable x6 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>thread z x2 x7 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.PageDirectory x7 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>thread z x2 x8 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Frame x8\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> Frame x8 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>thread z x2 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.Untyped\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.Untyped = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 8. \<And>thread z x2 x10 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = IRQNode x10\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> IRQNode x10 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 9. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (9 subgoals):
 1. \<And>thread z x2 x4 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.CNode x4 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>thread z x2 x5 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = AsidPool x5\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> AsidPool x5 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>thread z x2 x6 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.PageTable x6 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>thread z x2 x7 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.PageDirectory x7 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>thread z x2 x8 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Frame x8\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> Frame x8 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>thread z x2 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = cdl_object.Untyped\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> cdl_object.Untyped = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>thread z x2 x10 x2a. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); z = TCB x2a; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = IRQNode x10\<rbrakk> \<Longrightarrow> cdl_object.Untyped = x2 \<longrightarrow> IRQNode x10 = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 8. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z))
 9. \<And>thread x2a etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_ipcframe_id \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> \<noteq> Some buf; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a proof (prove)
goal (2 subgoals):
 1. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z))
 2. \<And>thread x2a etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_ipcframe_id \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> \<noteq> Some buf; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a proof (prove)
goal (2 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_ipcframe_id \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = transform_full_intent (machine_state s) thread x2a, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain etcb\<rparr> \<noteq> Some buf; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (3 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot = 4; (case infer_tcb_pending_op thread (tcb_state x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 2. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 3. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (3 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf\<rbrakk> \<Longrightarrow> get_tcb thread s = Some (?y662 thread x2a etcb)
 2. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; valid_tcb thread (?y662 thread x2a etcb) s\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 3. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; valid_tcb thread x2a s\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread x2a etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB x2a); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe x2a) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> tcb_ipcframe x2a; is_nondevice_page_cap (tcb_ipcframe x2a) \<or> cap.NullCap = tcb_ipcframe x2a; s \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s \<turnstile> tcb_ctable x2a; valid_ipc_buffer_cap (tcb_ipcframe x2a) (tcb_ipc_buffer x2a); valid_tcb_state (tcb_state x2a) s; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s; valid_arch_tcb (tcb_arch x2a) s\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread x2a = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread x2a
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe tcb) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> tcb_ipcframe tcb; is_nondevice_page_cap (tcb_ipcframe tcb) \<or> cap.NullCap = tcb_ipcframe tcb; s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (tcb_ipcframe tcb) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread tcb = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (3 subgoals):
 1. \<And>thread tcb etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe tcb) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> tcb_ipcframe tcb; is_nondevice_page_cap (tcb_ipcframe tcb) \<or> cap.NullCap = tcb_ipcframe tcb; s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (tcb_ipcframe tcb) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; \<not> is_arch_page_cap (tcb_ipcframe tcb)\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread tcb = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread tcb etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe tcb) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> tcb_ipcframe tcb; is_nondevice_page_cap (tcb_ipcframe tcb) \<or> cap.NullCap = tcb_ipcframe tcb; s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (tcb_ipcframe tcb) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; \<not> \<not> is_arch_page_cap (tcb_ipcframe tcb)\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread tcb = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 3. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; (case transform_cap (tcb_ipcframe tcb) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> tcb_ipcframe tcb; is_nondevice_page_cap (tcb_ipcframe tcb) \<or> cap.NullCap = tcb_ipcframe tcb; s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (tcb_ipcframe tcb) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; \<not> \<not> is_arch_page_cap (tcb_ipcframe tcb)\<rbrakk> \<Longrightarrow> transform_full_intent (machine_state s) thread tcb = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb x31 x32 x33 x34 x35. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; (case transform_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); is_nondevice_page_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 x32 x33 x34 x35)\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; (case transform_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) of FrameCap x oid xa xb xc xd \<Rightarrow> Some oid | _ \<Rightarrow> None) \<noteq> Some buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (13 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz783 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?buf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) s_id s
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_sz_at sz s_id s
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> pspace_aligned s
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> pspace_distinct s
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> within_page (?buf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) ptr sz
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page (?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) (?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz783 thread tcb etcb x31 word cap_rightsa vmpage_size option))) + word_of_nat x * word_of_nat word_size) (?osz783 thread tcb etcb x31 word cap_rightsa vmpage_size option)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz783 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?buf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) s_id s
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ipc_frame_sz_at sz s_id s
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> pspace_aligned s
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> pspace_distinct s
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> within_page (?buf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) ptr sz
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page (?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option) (?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz783 thread tcb etcb x31 word cap_rightsa vmpage_size option))) + word_of_nat x * word_of_nat word_size) (?osz783 thread tcb etcb x31 word cap_rightsa vmpage_size option)
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> ?obuf783 thread tcb etcb x31 word cap_rightsa vmpage_size option \<noteq> ?buf783 thread tcb etcb x31 word cap_rightsa vmpage_size option
A total of 12 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (4 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (10 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> valid_objs (?s794 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> pspace_aligned (?s794 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> pspace_distinct (?s794 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread (?s794 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> ipc_frame_sz_at vmpage_size thread (?s794 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> ipc_buffer_wp_at (tcb_ipc_buffer tcb) thread (?s794 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> word \<noteq> buf
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 10. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (4 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (3 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)\<rbrakk> \<Longrightarrow> word \<noteq> buf
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s) tcb [Suc (length msg_registers)..<Suc msg_max_length])) = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (length msg_registers)..<Suc msg_max_length])) \<and> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (3 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (14 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz802 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?buf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) s_id s
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_sz_at sz s_id s
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> pspace_aligned s
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> pspace_distinct s
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> within_page (?buf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) ptr sz
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]. within_page (?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) (?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz802 thread tcb etcb x31 word cap_rightsa vmpage_size option))) + word_of_nat x * word_of_nat word_size) (?osz802 thread tcb etcb x31 word cap_rightsa vmpage_size option)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz802 thread tcb etcb x31 word cap_rightsa vmpage_size option) thread s
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?buf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) s_id s
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ipc_frame_sz_at sz s_id s
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> pspace_aligned s
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> pspace_distinct s
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> within_page (?buf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) ptr sz
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]. within_page (?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option) (?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz802 thread tcb etcb x31 word cap_rightsa vmpage_size option))) + word_of_nat x * word_of_nat word_size) (?osz802 thread tcb etcb x31 word cap_rightsa vmpage_size option)
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> ?obuf802 thread tcb etcb x31 word cap_rightsa vmpage_size option \<noteq> ?buf802 thread tcb etcb x31 word cap_rightsa vmpage_size option
A total of 13 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (11 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> valid_objs (?s813 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> pspace_aligned (?s813 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> pspace_distinct (?s813 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread (?s813 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> ipc_frame_sz_at vmpage_size thread (?s813 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> ipc_buffer_wp_at (tcb_ipc_buffer tcb) thread (?s813 thread tcb etcb x31 word cap_rightsa vmpage_size option x)
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
A total of 11 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; x < 122 + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> x < 128
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x x1 x2 x3 x4. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); \<exists>ko. kheap s s_id = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False)); is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; x < 122 + unat (mi_extra_caps (get_tcb_message_info tcb)); get_tcb_message_info tcb = MI x1 x2 x3 x4\<rbrakk> \<Longrightarrow> x < 128
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; x < 122 + unat ((arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && mask 2); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> x < 128
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> 122 + unat ((arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && mask 2) \<le> 128
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> unat ((arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && 3) \<le> 6
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> (arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && 3 \<le> 6
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (6 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> (arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && 3 \<le> ?y848 thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ?y848 thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba \<le> 6
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 6. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (5 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option x tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); 122 \<le> x; kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> 3 \<le> 6
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (machine_state s) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else [])\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (2 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (13 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) thread s
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) thread s
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?buf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) s_id s
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_sz_at sz s_id s
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> pspace_aligned s
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> pspace_distinct s
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> within_page (?buf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) ptr sz
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]. within_page (?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) (?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba))) + word_of_nat x * word_of_nat word_size) (?osz865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) thread s
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) thread s
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?buf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) s_id s
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ipc_frame_sz_at sz s_id s
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> pspace_aligned s
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> pspace_distinct s
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> within_page (?buf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) ptr sz
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]. within_page (?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba) (?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba))) + word_of_nat x * word_of_nat word_size) (?osz865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba)
 10. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> ?obuf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba \<noteq> ?buf865 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba
A total of 12 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (4 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (10 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> valid_objs (?s876 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x)
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> pspace_aligned (?s876 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x)
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> pspace_distinct (?s876 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x)
 4. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread (?s876 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x)
 5. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> ipc_frame_sz_at vmpage_size thread (?s876 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x)
 6. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> ipc_buffer_wp_at (tcb_ipc_buffer tcb) thread (?s876 thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x)
 7. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 8. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> word \<noteq> buf
 9. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 10. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (4 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba x. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> word \<noteq> buf
 3. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (3 subgoals):
 1. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> word \<noteq> buf
 2. \<And>thread tcb etcb x31 word cap_rightsa vmpage_size option tcba. \<lbrakk>ekheap s thread = Some etcb; pspace_aligned s; pspace_distinct s; valid_objs s; is_aligned ptr 2; within_page buf ptr sz; thread \<noteq> idle_thread s; kheap s thread = Some (TCB tcb); tcb_pending_op_slot \<noteq> 4; word \<noteq> buf; s \<turnstile> ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); is_nondevice_page_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)); s \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s \<turnstile> tcb_ctable tcb; valid_ipc_buffer_cap (ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option)) (tcb_ipc_buffer tcb); valid_tcb_state (tcb_state tcb) s; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s; valid_arch_tcb (tcb_arch tcb) s; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word cap_rightsa vmpage_size option); get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); kheap s s_id = Some (TCB tcba); case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; case tcb_ipcframe tcba of ArchObjectCap (PageCap dev ptr rights sza mapdata) \<Rightarrow> sz = sza | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (machine_state s) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s)) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (1 subgoal):
 1. \<And>thread z. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z\<rbrakk> \<Longrightarrow> \<forall>x2. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2 \<longrightarrow> (((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = None \<longrightarrow> x2 = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2. ((case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = None \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z) \<and> (\<forall>x2a. (case transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z of Tcb tcb \<Rightarrow> if tcb_ipcframe_id tcb = Some buf then Some (Tcb (dupdate_tcb_intent (?f141 thread) tcb)) else None | _ \<Rightarrow> None) = Some x2a \<longrightarrow> ((\<lambda>ptr. Some cdl_object.Untyped) |` (- {idle_thread s})) thread = Some x2 \<longrightarrow> x2a = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z)) proof (prove)
goal (1 subgoal):
 1. \<And>thread z x3 x171 x173 x174 x175 x176. \<lbrakk>transform_object (machine_state s) thread ((ekheap s |` (- {idle_thread s})) thread) z = Tcb x3; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some z; cdl_tcb_caps x3 tcb_ipcbuffer_slot = Some (FrameCap x171 buf x173 x174 x175 x176)\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = transform_object (storeWord_ms ptr b (machine_state s)) thread ((ekheap s |` (- {idle_thread s})) thread) z proof (prove)
goal (1 subgoal):
 1. \<And>thread x3 x171 x173 x174 x175 x176 x2. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some (TCB x2); cdl_tcb_caps x3 tcb_ipcbuffer_slot = Some (FrameCap x171 buf x173 x174 x175 x176); (case (ekheap s |` (- {idle_thread s})) thread of Some x2a \<Rightarrow> transform_tcb (machine_state s) thread x2 x2a) = Tcb x3\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = (case (ekheap s |` (- {idle_thread s})) thread of Some x2a \<Rightarrow> transform_tcb (storeWord_ms ptr b (machine_state s)) thread x2 x2a) proof (prove)
goal (1 subgoal):
 1. \<And>thread x3 x171 x173 x174 x175 x176 tcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some (TCB tcb); cdl_tcb_caps x3 tcb_ipcbuffer_slot = Some (FrameCap x171 buf x173 x174 x175 x176); (case (ekheap s |` (- {idle_thread s})) thread of Some x2 \<Rightarrow> transform_tcb (machine_state s) thread tcb x2) = Tcb x3\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = (case (ekheap s |` (- {idle_thread s})) thread of Some x2 \<Rightarrow> transform_tcb (storeWord_ms ptr b (machine_state s)) thread tcb x2) proof (prove)
goal (1 subgoal):
 1. \<And>thread x3 x171 x173 x174 x175 x176 tcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (kheap s |` (- {idle_thread s})) thread = Some (TCB tcb); cdl_tcb_caps x3 tcb_ipcbuffer_slot = Some (FrameCap x171 buf x173 x174 x175 x176); (case (ekheap s |` (- {idle_thread s})) thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe tcb), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (machine_state s) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Tcb x3\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = (case (ekheap s |` (- {idle_thread s})) thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe tcb), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>thread x3 x171 x173 x174 x175 x176 tcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; cdl_tcb_caps x3 tcb_ipcbuffer_slot = Some (FrameCap x171 buf x173 x174 x175 x176); (case (ekheap s |` (- {idle_thread s})) thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe tcb), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (machine_state s) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Tcb x3; Some (TCB tcb) = (kheap s |` (- {idle_thread s})) thread\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = (case (ekheap s |` (- {idle_thread s})) thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe tcb), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>thread x3 x171 x173 x174 x175 x176 tcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; cdl_tcb_caps x3 4 = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (machine_state s) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Tcb x3\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>thread x3 x171 x173 x174 x175 x176 tcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; cdl_tcb_caps x3 4 = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (machine_state s) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = Tcb x3; \<exists>etcb. ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> Tcb (dupdate_tcb_intent (?f900 thread) x3) = (case ekheap s thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> ?f900 thread = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb proof (prove)
goal (2 subgoals):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; get_tcb thread s = Some tcb\<rbrakk> \<Longrightarrow> ?f900 thread = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb proof (prove)
goal (2 subgoals):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb)\<rbrakk> \<Longrightarrow> ?f900 thread = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb proof (prove)
goal (3 subgoals):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb); tcb = the (get_tcb thread s)\<rbrakk> \<Longrightarrow> ?f900 thread = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb)\<rbrakk> \<Longrightarrow> tcb = the (get_tcb thread s)
 3. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb proof (prove)
goal (4 subgoals):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb); tcb = the (get_tcb thread s); etcb = the (get_etcb thread s)\<rbrakk> \<Longrightarrow> ?f900 thread = transform_full_intent (storeWord_ms ptr b (machine_state s)) thread tcb
 2. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb); tcb = the (get_tcb thread s)\<rbrakk> \<Longrightarrow> etcb = the (get_etcb thread s)
 3. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb)\<rbrakk> \<Longrightarrow> tcb = the (get_tcb thread s)
 4. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb proof (prove)
goal (3 subgoals):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb); tcb = the (get_tcb thread s)\<rbrakk> \<Longrightarrow> etcb = the (get_etcb thread s)
 2. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb)\<rbrakk> \<Longrightarrow> tcb = the (get_tcb thread s)
 3. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb proof (prove)
goal (2 subgoals):
 1. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb; kheap s thread = Some (TCB tcb)\<rbrakk> \<Longrightarrow> tcb = the (get_tcb thread s)
 2. \<And>thread x171 x173 x174 x175 x176 tcb etcb. \<lbrakk>Some (TCB tcb) = kheap s thread; pspace_aligned s; pspace_distinct s; valid_objs s; valid_etcbs s; ipc_frame_ptr_at buf s_id s; ipc_frame_sz_at sz s_id s; is_aligned ptr 2; within_page buf ptr sz; (if tcb_boundntfn_slot = 4 then Some (infer_tcb_bound_notification (tcb_bound_notification tcb)) else [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), 4 \<mapsto> transform_cap (tcb_ipcframe tcb), 5 \<mapsto> infer_tcb_pending_op thread (tcb_state tcb)] 4) = Some (FrameCap x171 buf x173 x174 x175 x176); thread \<noteq> idle_thread s; ekheap s thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s = Some tcb proof (prove)
goal:
No subgoals!