theory Intent_DR

lemma dcorres_store_word_safe:
  "within_page obuf ptr sz \<Longrightarrow>
   dcorres dc \<top>
    (ko_at (ArchObj (DataPage dev sz)) obuf and (\<lambda>s. \<forall>buf thread. ipc_frame_ptr_at buf thread s \<longrightarrow> buf\<noteq> obuf) and
    valid_objs and pspace_distinct and pspace_aligned and valid_etcbs)
    (return a)
    (do_machine_op (storeWord ptr b))" supply option.case_cong[cong] apply (rule dcorres_expand_pfx) apply (clarsimp simp: do_machine_op_def valid_def get_def gets_def bind_def return_def
                        simpler_modify_def corres_underlying_def) apply (clarsimp simp: select_f_store_word assert_def bind_def fail_def return_def
                  split: if_splits) apply (clarsimp simp: transform_def transform_current_thread_def) apply (rule ext) apply (rename_tac thread) apply (clarsimp simp:transform_objects_def restrict_map_def option_map_def map_add_def split:option.splits) apply (clarsimp simp:transform_object_def split:Structures_A.kernel_object.splits) apply (clarsimp simp:transform_tcb_def transform_full_intent_def Let_def) apply (clarsimp simp del:upt.simps
                   simp: Let_def get_tcb_mrs_def is_arch_page_cap_def
                   split:cap.split_asm arch_cap.split_asm
                   split del: if_split) apply (frule valid_tcb_objs, erule get_tcb_rev) apply (clarsimp simp: valid_tcb_def tcb_cap_cases_def valid_ipc_buffer_cap_def
               simp del: upt.simps) apply (erule disjE) apply (clarsimp simp: is_nondevice_page_cap_def split: cap.split_asm simp del: upt.simps) apply (rename_tac tcb arch_cap) apply (case_tac arch_cap) apply ((simp add:get_ipc_buffer_words_def)+)[2] apply (rename_tac word rights vmpage_size option) apply (simp add:Suc_leI[OF msg_registers_lt_msg_max_length] del:upt.simps) apply (frule_tac thread = thread and ptr = ptr and ms = "machine_state s'"
                   and tcb_type = tcb and b = b
                   and xs = "[Suc (length msg_registers)..<Suc msg_max_length]"
                    in get_ipc_buffer_words_helper) apply (erule get_tcb_rev) apply ((simp add:ipc_frame_wp_at_def obj_at_def)+)[2] apply (simp add:obj_at_def) apply (clarsimp simp: is_aligned_mask split: bool.split_asm simp del: upt.simps)+ apply (rule_tac y = thread in within_page_ipc_buf) apply (simp add:ipc_frame_wp_at_def obj_at_def ipc_buffer_wp_at_def)+ apply (simp add:msg_max_length_def msg_align_bits) apply (subgoal_tac "ipc_frame_ptr_at word thread s'") apply (drule_tac x = word in spec) apply clarsimp apply (clarsimp simp:ipc_frame_wp_at_def obj_at_def) apply (frule(1) valid_etcbs_tcb_etcb, clarsimp) apply (rule conjI) apply (frule_tac thread = thread and ptr = ptr and ms = "machine_state s'"
                    and tcb_type = tcb and b = b
                    and xs = "[buffer_cptr_index..<buffer_cptr_index +
                               unat (mi_extra_caps (get_tcb_message_info tcb))]"
                     in get_ipc_buffer_words_helper) apply (erule get_tcb_rev) apply ((simp add:ipc_frame_wp_at_def obj_at_def is_aligned_mask)+)[7] apply (clarsimp simp del:upt.simps) apply (rule_tac sz = vmpage_size and y = thread in within_page_ipc_buf) apply (simp add:ipc_frame_wp_at_def obj_at_def ipc_buffer_wp_at_def)+ apply (simp add:msg_max_length_def msg_align_bits buffer_cptr_index_def) apply (case_tac "get_tcb_message_info tcb") apply (clarsimp simp add: get_tcb_message_info_def data_to_message_info_def) apply (erule order_less_le_trans) apply (simp add: mask_def) apply (rule iffD1[OF word_le_nat_alt[where b = "0x6::word32",simplified]]) apply (rule order_trans) apply (rule word_and_le1[where a = 3]) apply simp apply (subgoal_tac "ipc_frame_ptr_at word thread s'") apply (drule_tac x = word in spec) apply clarsimp apply (clarsimp simp:ipc_frame_wp_at_def obj_at_def) apply simp apply (frule_tac thread = thread and ptr = ptr and sz = sz and ms = "machine_state s'"
                   and tcb_type = tcb and b = b
                   and xs = "[Suc (Suc (msg_max_length + msg_max_extra_caps))..<
                              5 + (msg_max_length + msg_max_extra_caps)]"
                    in get_ipc_buffer_words_helper) apply (erule get_tcb_rev) apply ((simp add:ipc_frame_wp_at_def is_aligned_mask obj_at_def)+)[7] apply (clarsimp simp del:upt.simps) apply (rule_tac y = thread and sz = vmpage_size in within_page_ipc_buf) apply (simp add:ipc_frame_wp_at_def obj_at_def ipc_buffer_wp_at_def)+ apply (clarsimp simp:msg_align_bits msg_max_length_def msg_max_extra_caps_def) apply (subgoal_tac "ipc_frame_ptr_at word thread s'") apply (drule_tac x = word in spec) apply clarsimp apply (clarsimp simp:ipc_frame_wp_at_def obj_at_def) apply simp apply (clarsimp simp:get_ipc_buffer_words_def)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. within_page obuf ptr sz \<Longrightarrow> dcorres dc (\<lambda>_. True) (ako_at (DataPage dev sz) obuf and (\<lambda>s. \<forall>buf thread. ipc_frame_ptr_at buf thread s \<longrightarrow> buf \<noteq> obuf) and valid_objs and pspace_distinct and pspace_aligned and valid_etcbs) (return a) (do_machine_op (storeWord ptr b)) proof (prove)
goal (1 subgoal):
 1. within_page obuf ptr sz \<Longrightarrow> dcorres dc (\<lambda>_. True) (ako_at (DataPage dev sz) obuf and (\<lambda>s. \<forall>buf thread. ipc_frame_ptr_at buf thread s \<longrightarrow> buf \<noteq> obuf) and valid_objs and pspace_distinct and pspace_aligned and valid_etcbs) (return a) (do_machine_op (storeWord ptr b)) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>within_page obuf ptr sz; s = transform s'; True; (ako_at (DataPage dev sz) obuf and (\<lambda>s. \<forall>buf thread. ipc_frame_ptr_at buf thread s \<longrightarrow> buf \<noteq> obuf) and valid_objs and pspace_distinct and pspace_aligned and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (return a) (do_machine_op (storeWord ptr b)) proof (prove)
goal (1 subgoal):
 1. \<And>s' ba baa. \<lbrakk>within_page obuf ptr sz; (((), ba), baa) \<in> fst (select_f (storeWord ptr b (machine_state s')) s'); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> transform (update_machine ba baa) = transform s' proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0\<rbrakk> \<Longrightarrow> transform (update_machine (storeWord_ms ptr b (machine_state s')) s') = transform s' proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0\<rbrakk> \<Longrightarrow> transform_objects (update_machine (storeWord_ms ptr b (machine_state s')) s') = transform_objects s' proof (prove)
goal (1 subgoal):
 1. \<And>s' x. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0\<rbrakk> \<Longrightarrow> transform_objects (update_machine (storeWord_ms ptr b (machine_state s')) s') x = transform_objects s' x proof (prove)
goal (1 subgoal):
 1. \<And>s' thread. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0\<rbrakk> \<Longrightarrow> transform_objects (update_machine (storeWord_ms ptr b (machine_state s')) s') thread = transform_objects s' thread proof (prove)
goal (1 subgoal):
 1. \<And>s' thread x2. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some x2; thread \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> transform_object (storeWord_ms ptr b (machine_state s')) thread (ekheap s' thread) x2 = transform_object (machine_state s') thread (ekheap s' thread) x2 proof (prove)
goal (1 subgoal):
 1. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> transform_tcb (storeWord_ms ptr b (machine_state s')) thread x2a x2) = (case ekheap s' thread of Some x2 \<Rightarrow> transform_tcb (machine_state s') thread x2a x2) proof (prove)
goal (1 subgoal):
 1. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (get_tcb_mrs (storeWord_ms ptr b (machine_state s')) x2a), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (get_tcb_mrs (machine_state s') x2a), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; valid_tcb thread x2a s'\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; is_nondevice_page_cap (tcb_ipcframe x2a) \<or> cap.NullCap = tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; is_nondevice_page_cap (tcb_ipcframe x2a)\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>s' thread x2a x12. \<lbrakk>valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; is_nondevice_page_cap_arch x12; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap x12; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; tcb_ipcframe x2a = ArchObjectCap x12; case x12 of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer x2a) msg_align_bits | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap x12), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap x12), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>s' thread tcb arch_cap. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb arch_cap x11 x12. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread tcb arch_cap. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = ASIDControlCap\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x31 x32 x33 x34 x35. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb arch_cap x31 x32 x33 x34 x35. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (14 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> get_tcb thread s' = Some tcb
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option) thread s'
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz181 s' thread tcb arch_cap x31 word rights vmpage_size option) thread s'
 4. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev181 s' thread tcb arch_cap x31 word rights vmpage_size option) (?sz181 s' thread tcb arch_cap x31 word rights vmpage_size option)) (?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option) s'
 5. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 6. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_aligned s'
 7. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_distinct s'
 8. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> within_page (?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option) ptr (?sz181 s' thread tcb arch_cap x31 word rights vmpage_size option)
 9. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page (?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option) (?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz181 s' thread tcb arch_cap x31 word rights vmpage_size option))) + word_of_nat x * word_of_nat word_size) (?osz181 s' thread tcb arch_cap x31 word rights vmpage_size option)
 10. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option \<noteq> ?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option) thread s'
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz181 s' thread tcb arch_cap x31 word rights vmpage_size option) thread s'
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev181 s' thread tcb arch_cap x31 word rights vmpage_size option) (?sz181 s' thread tcb arch_cap x31 word rights vmpage_size option)) (?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option) s'
 4. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 5. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_aligned s'
 6. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_distinct s'
 7. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> within_page (?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option) ptr (?sz181 s' thread tcb arch_cap x31 word rights vmpage_size option)
 8. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page (?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option) (?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz181 s' thread tcb arch_cap x31 word rights vmpage_size option))) + word_of_nat x * word_of_nat word_size) (?osz181 s' thread tcb arch_cap x31 word rights vmpage_size option)
 9. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ?obuf181 s' thread tcb arch_cap x31 word rights vmpage_size option \<noteq> ?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option
 10. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
A total of 13 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev181 s' thread tcb arch_cap x31 word rights vmpage_size option) (?sz181 s' thread tcb arch_cap x31 word rights vmpage_size option)) (?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option) s'
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_aligned s'
 4. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_distinct s'
 5. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> within_page (?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option) ptr (?sz181 s' thread tcb arch_cap x31 word rights vmpage_size option)
 6. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 7. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> word \<noteq> ?buf181 s' thread tcb arch_cap x31 word rights vmpage_size option
 8. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 9. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 10. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_aligned s'
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> pspace_distinct s'
 4. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> within_page obuf ptr sz
 5. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (length msg_registers)..<Suc msg_max_length]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 6. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 7. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 8. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 9. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 10. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (12 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> valid_objs (?s206 s' thread tcb x31 word rights vmpage_size option x)
 2. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> pspace_aligned (?s206 s' thread tcb x31 word rights vmpage_size option x)
 3. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> pspace_distinct (?s206 s' thread tcb x31 word rights vmpage_size option x)
 4. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread (?s206 s' thread tcb x31 word rights vmpage_size option x)
 5. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> ipc_frame_sz_at vmpage_size thread (?s206 s' thread tcb x31 word rights vmpage_size option x)
 6. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> ipc_buffer_wp_at (tcb_ipc_buffer tcb) thread (?s206 s' thread tcb x31 word rights vmpage_size option x)
 7. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 8. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 9. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 10. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
A total of 12 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap False word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap False word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap False word rights vmpage_size option); \<not> x31; tcb_ipc_buffer tcb && mask msg_align_bits = 0; Suc (length msg_registers) \<le> x; x < Suc msg_max_length\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; ipc_frame_ptr_at word thread s'\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; ipc_frame_ptr_at word thread s'; (\<exists>thread. ipc_frame_ptr_at word thread s') \<longrightarrow> word \<noteq> obuf\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 3. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 2. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb arch_cap x31 word rights vmpage_size option. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; arch_cap = PageCap x31 word rights vmpage_size option; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length] = get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length]\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap (PageCap x31 word rights vmpage_size option)), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] \<and> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (15 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s' = Some tcb
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf234 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz234 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev234 s' thread tcb x31 word rights vmpage_size option etcb) (?sz234 s' thread tcb x31 word rights vmpage_size option etcb)) (?buf234 s' thread tcb x31 word rights vmpage_size option etcb) s'
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 6. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_aligned s'
 7. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_distinct s'
 8. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> within_page (?buf234 s' thread tcb x31 word rights vmpage_size option etcb) ptr (?sz234 s' thread tcb x31 word rights vmpage_size option etcb)
 9. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]. within_page (?obuf234 s' thread tcb x31 word rights vmpage_size option etcb) (?obuf234 s' thread tcb x31 word rights vmpage_size option etcb + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz234 s' thread tcb x31 word rights vmpage_size option etcb))) + word_of_nat x * word_of_nat word_size) (?osz234 s' thread tcb x31 word rights vmpage_size option etcb)
 10. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ?obuf234 s' thread tcb x31 word rights vmpage_size option etcb \<noteq> ?buf234 s' thread tcb x31 word rights vmpage_size option etcb
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf234 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz234 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev234 s' thread tcb x31 word rights vmpage_size option etcb) (?sz234 s' thread tcb x31 word rights vmpage_size option etcb)) (?buf234 s' thread tcb x31 word rights vmpage_size option etcb) s'
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_aligned s'
 6. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_distinct s'
 7. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> within_page (?buf234 s' thread tcb x31 word rights vmpage_size option etcb) ptr (?sz234 s' thread tcb x31 word rights vmpage_size option etcb)
 8. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]. within_page (?obuf234 s' thread tcb x31 word rights vmpage_size option etcb) (?obuf234 s' thread tcb x31 word rights vmpage_size option etcb + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz234 s' thread tcb x31 word rights vmpage_size option etcb))) + word_of_nat x * word_of_nat word_size) (?osz234 s' thread tcb x31 word rights vmpage_size option etcb)
 9. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ?obuf234 s' thread tcb x31 word rights vmpage_size option etcb \<noteq> ?buf234 s' thread tcb x31 word rights vmpage_size option etcb
 10. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
A total of 14 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (13 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> valid_objs (?s247 s' thread tcb x31 word rights vmpage_size option etcb x)
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> pspace_aligned (?s247 s' thread tcb x31 word rights vmpage_size option etcb x)
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> pspace_distinct (?s247 s' thread tcb x31 word rights vmpage_size option etcb x)
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread (?s247 s' thread tcb x31 word rights vmpage_size option etcb x)
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> ipc_frame_sz_at vmpage_size thread (?s247 s' thread tcb x31 word rights vmpage_size option etcb x)
 6. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> ipc_buffer_wp_at (tcb_ipc_buffer tcb) thread (?s247 s' thread tcb x31 word rights vmpage_size option etcb x)
 7. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 8. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 9. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 10. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
A total of 13 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; buffer_cptr_index \<le> x; x < buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x; x < 122 + unat (mi_extra_caps (get_tcb_message_info tcb))\<rbrakk> \<Longrightarrow> x < 128
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x x1 x2 x3 x4. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x; x < 122 + unat (mi_extra_caps (get_tcb_message_info tcb)); get_tcb_message_info tcb = MI x1 x2 x3 x4\<rbrakk> \<Longrightarrow> x < 128
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x; x < 122 + unat ((arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && mask 2)\<rbrakk> \<Longrightarrow> x < 128
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x\<rbrakk> \<Longrightarrow> 122 + unat ((arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && mask 2) \<le> 128
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && 3 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x\<rbrakk> \<Longrightarrow> unat ((arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && 3) \<le> 6
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && 3 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x\<rbrakk> \<Longrightarrow> (arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && 3 \<le> 6
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (8 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && 3 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x\<rbrakk> \<Longrightarrow> (arch_tcb_context_get (tcb_arch tcb) msg_info_register >> 7) && 3 \<le> ?y274 s' thread tcb x31 word rights vmpage_size option etcb x
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && 3 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x\<rbrakk> \<Longrightarrow> ?y274 s' thread tcb x31 word rights vmpage_size option etcb x \<le> 6
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 6. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 8. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && 3 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if length msg_registers \<le> 119 then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; 122 \<le> x\<rbrakk> \<Longrightarrow> 3 \<le> 6
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; ipc_frame_ptr_at word thread s'\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (7 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; ipc_frame_ptr_at word thread s'; (\<exists>thread. ipc_frame_ptr_at word thread s') \<longrightarrow> word \<noteq> obuf\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 5. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 7. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]\<rbrakk> \<Longrightarrow> get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))] = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))]
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (14 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> get_tcb thread s' = Some tcb
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf285 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz285 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev285 s' thread tcb x31 word rights vmpage_size option etcb) sz) (?buf285 s' thread tcb x31 word rights vmpage_size option etcb) s'
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 6. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_aligned s'
 7. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_distinct s'
 8. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> within_page (?buf285 s' thread tcb x31 word rights vmpage_size option etcb) ptr sz
 9. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]. within_page (?obuf285 s' thread tcb x31 word rights vmpage_size option etcb) (?obuf285 s' thread tcb x31 word rights vmpage_size option etcb + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz285 s' thread tcb x31 word rights vmpage_size option etcb))) + word_of_nat x * word_of_nat word_size) (?osz285 s' thread tcb x31 word rights vmpage_size option etcb)
 10. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ?obuf285 s' thread tcb x31 word rights vmpage_size option etcb \<noteq> ?buf285 s' thread tcb x31 word rights vmpage_size option etcb
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at (?obuf285 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_sz_at (?osz285 s' thread tcb x31 word rights vmpage_size option etcb) thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ako_at (DataPage (?dev285 s' thread tcb x31 word rights vmpage_size option etcb) sz) (?buf285 s' thread tcb x31 word rights vmpage_size option etcb) s'
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> is_aligned ptr 2
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_aligned s'
 6. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> pspace_distinct s'
 7. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> within_page (?buf285 s' thread tcb x31 word rights vmpage_size option etcb) ptr sz
 8. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]. within_page (?obuf285 s' thread tcb x31 word rights vmpage_size option etcb) (?obuf285 s' thread tcb x31 word rights vmpage_size option etcb + (tcb_ipc_buffer tcb && mask (pageBitsForSize (?osz285 s' thread tcb x31 word rights vmpage_size option etcb))) + word_of_nat x * word_of_nat word_size) (?osz285 s' thread tcb x31 word rights vmpage_size option etcb)
 9. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ?obuf285 s' thread tcb x31 word rights vmpage_size option etcb \<noteq> ?buf285 s' thread tcb x31 word rights vmpage_size option etcb
 10. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
A total of 13 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> \<forall>x\<in>set [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]. within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> within_page word (word + (tcb_ipc_buffer tcb && mask (pageBitsForSize vmpage_size)) + word_of_nat x * word_of_nat word_size) vmpage_size
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (12 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> valid_objs (?s298 s' thread tcb x31 word rights vmpage_size option etcb x)
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> pspace_aligned (?s298 s' thread tcb x31 word rights vmpage_size option etcb x)
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> pspace_distinct (?s298 s' thread tcb x31 word rights vmpage_size option etcb x)
 4. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread (?s298 s' thread tcb x31 word rights vmpage_size option etcb x)
 5. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> ipc_frame_sz_at vmpage_size thread (?s298 s' thread tcb x31 word rights vmpage_size option etcb x)
 6. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> ipc_buffer_wp_at (tcb_ipc_buffer tcb) thread (?s298 s' thread tcb x31 word rights vmpage_size option etcb x)
 7. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 8. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 9. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 10. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
A total of 12 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb x. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); kheap s' obuf = Some (ArchObj (DataPage dev sz)); \<forall>buf. (\<exists>thread ko. kheap s' thread = Some ko \<and> (\<exists>tcb. ko = TCB tcb \<and> (case tcb_ipcframe tcb of ArchObjectCap (PageCap dev ptr rights sz mapdata) \<Rightarrow> buf = ptr | ArchObjectCap _ \<Rightarrow> False | _ \<Rightarrow> False))) \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; Suc (Suc (msg_max_length + msg_max_extra_caps)) \<le> x; x < 5 + (msg_max_length + msg_max_extra_caps)\<rbrakk> \<Longrightarrow> x < 2 ^ (msg_align_bits - 2)
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; ipc_frame_ptr_at word thread s'\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; ipc_frame_ptr_at word thread s'; (\<exists>thread. ipc_frame_ptr_at word thread s') \<longrightarrow> word \<noteq> obuf\<rbrakk> \<Longrightarrow> word \<noteq> obuf
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 3. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 4. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 6. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb\<rbrakk> \<Longrightarrow> ipc_frame_ptr_at word thread s'
 2. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 3. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 5. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>s' thread tcb x31 word rights vmpage_size option etcb. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch (PageCap x31 word rights vmpage_size option); ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap (PageCap x31 word rights vmpage_size option); s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap (PageCap x31 word rights vmpage_size option); case x31 of True \<Rightarrow> False | False \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []) = get_ipc_buffer_words (machine_state s') tcb (if Suc (length msg_registers) \<le> msg_max_length then [Suc (length msg_registers)..<msg_max_length] @ [msg_max_length] else []); ekheap s' thread = Some etcb; get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] = get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)]\<rbrakk> \<Longrightarrow> (case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None) = (case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None)
 2. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 4. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal (3 subgoals):
 1. \<And>s' thread tcb arch_cap x41 x42. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 2. \<And>s' thread tcb arch_cap x51 x52. \<lbrakk>valid_tcb_state (tcb_state tcb) s'; case tcb_fault tcb of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler tcb) = word_bits; valid_bound_ntfn (tcb_bound_notification tcb) s'; valid_arch_tcb (tcb_arch tcb) s'; is_nondevice_page_cap_arch arch_cap; ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB tcb); thread \<noteq> idle_thread s'; s' \<turnstile> ArchObjectCap arch_cap; s' \<turnstile> tcb_caller tcb; (case tcb_state tcb of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller tcb); s' \<turnstile> tcb_reply tcb; is_master_reply_cap (tcb_reply tcb) \<and> obj_ref_of (tcb_reply tcb) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply tcb) \<or> halted (tcb_state tcb) \<and> tcb_reply tcb = cap.NullCap; s' \<turnstile> tcb_vtable tcb; is_valid_vtable_root (tcb_vtable tcb) \<or> cap.NullCap = tcb_vtable tcb; s' \<turnstile> tcb_ctable tcb; tcb_ipcframe tcb = ArchObjectCap arch_cap; case arch_cap of PageCap True ref rghts sz mapdata \<Rightarrow> False | PageCap False ref rghts sz mapdata \<Rightarrow> is_aligned (tcb_ipc_buffer tcb) msg_align_bits | _ \<Rightarrow> False; arch_cap = arch_cap.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable tcb), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable tcb), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply tcb), tcb_caller_slot \<mapsto> transform_cap (tcb_caller tcb), tcb_ipcbuffer_slot \<mapsto> transform_cap (ArchObjectCap arch_cap), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state tcb), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification tcb)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler tcb), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info tcb))) (take (unat (mi_length (get_tcb_message_info tcb))) (map (arch_tcb_context_get (tcb_arch tcb)) msg_registers) @ take (unat (mi_length (get_tcb_message_info tcb)) - length msg_registers) (get_ipc_buffer_words (machine_state s') tcb [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info tcb)), cdl_intent_cap = arch_tcb_context_get (tcb_arch tcb) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') tcb [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info tcb))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') tcb [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault tcb = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>)
 3. \<And>s' thread x2a. \<lbrakk>ako_at (DataPage dev sz) obuf s'; \<forall>buf. (\<exists>thread. ipc_frame_ptr_at buf thread s') \<longrightarrow> buf \<noteq> obuf; valid_objs s'; pspace_distinct s'; pspace_aligned s'; valid_etcbs s'; within_page obuf ptr sz; ptr && mask 2 = 0; kheap s' thread = Some (TCB x2a); thread \<noteq> idle_thread s'; s' \<turnstile> tcb_ipcframe x2a; s' \<turnstile> tcb_caller x2a; (case tcb_state x2a of BlockedOnReceive e data \<Rightarrow> (=) cap.NullCap | _ \<Rightarrow> is_reply_cap or (=) cap.NullCap) (tcb_caller x2a); s' \<turnstile> tcb_reply x2a; is_master_reply_cap (tcb_reply x2a) \<and> obj_ref_of (tcb_reply x2a) = thread \<and> AllowGrant \<in> Structures_A.cap_rights (tcb_reply x2a) \<or> halted (tcb_state x2a) \<and> tcb_reply x2a = cap.NullCap; s' \<turnstile> tcb_vtable x2a; is_valid_vtable_root (tcb_vtable x2a) \<or> cap.NullCap = tcb_vtable x2a; s' \<turnstile> tcb_ctable x2a; case tcb_ipcframe x2a of cap.NullCap \<Rightarrow> True | ArchObjectCap acap \<Rightarrow> valid_ipc_buffer_cap_arch acap (tcb_ipc_buffer x2a) | _ \<Rightarrow> False; valid_tcb_state (tcb_state x2a) s'; case tcb_fault x2a of None \<Rightarrow> True | Some x2 \<Rightarrow> valid_fault x2; length (tcb_fault_handler x2a) = word_bits; valid_bound_ntfn (tcb_bound_notification x2a) s'; valid_arch_tcb (tcb_arch x2a) s'; cap.NullCap = tcb_ipcframe x2a\<rbrakk> \<Longrightarrow> (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (storeWord_ms ptr b (machine_state s')) x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) = (case ekheap s' thread of Some x2 \<Rightarrow> Tcb \<lparr>cdl_tcb_caps = [tcb_cspace_slot \<mapsto> transform_cap (tcb_ctable x2a), tcb_vspace_slot \<mapsto> transform_cap (tcb_vtable x2a), tcb_replycap_slot \<mapsto> transform_cap (tcb_reply x2a), tcb_caller_slot \<mapsto> transform_cap (tcb_caller x2a), tcb_ipcbuffer_slot \<mapsto> transform_cap (tcb_ipcframe x2a), tcb_pending_op_slot \<mapsto> infer_tcb_pending_op thread (tcb_state x2a), tcb_boundntfn_slot \<mapsto> infer_tcb_bound_notification (tcb_bound_notification x2a)], cdl_tcb_fault_endpoint = of_bl (tcb_fault_handler x2a), cdl_tcb_intent = \<lparr>cdl_intent_op = transform_intent (invocation_type (mi_label (get_tcb_message_info x2a))) (take (unat (mi_length (get_tcb_message_info x2a))) (map (arch_tcb_context_get (tcb_arch x2a)) msg_registers) @ take (unat (mi_length (get_tcb_message_info x2a)) - length msg_registers) (get_ipc_buffer_words (machine_state s') x2a [Suc (length msg_registers)..<Suc msg_max_length])), cdl_intent_error = guess_error (mi_label (get_tcb_message_info x2a)), cdl_intent_cap = arch_tcb_context_get (tcb_arch x2a) cap_register, cdl_intent_extras = get_ipc_buffer_words (machine_state s') x2a [buffer_cptr_index..<buffer_cptr_index + unat (mi_extra_caps (get_tcb_message_info x2a))], cdl_intent_recv_slot = case get_ipc_buffer_words (machine_state s') x2a [Suc (Suc (msg_max_length + msg_max_extra_caps))..<5 + (msg_max_length + msg_max_extra_caps)] of [] \<Rightarrow> None | [croot] \<Rightarrow> None | [croot, index] \<Rightarrow> None | [croot, index, depth] \<Rightarrow> Some (croot, index, unat depth) | croot # index # depth # ac # lista \<Rightarrow> None\<rparr>, cdl_tcb_has_fault = \<exists>y. tcb_fault x2a = Some y, cdl_tcb_domain = tcb_domain x2\<rparr>) proof (prove)
goal:
No subgoals!