theory Ipc_DR

lemma dcorres_transfer_caps_loop:
  "\<lbrakk> dest = dest_of dests;
     caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps';
     ep = ep' \<rbrakk> \<Longrightarrow>
   dcorres (\<lambda>_ _. True) \<top>
            (valid_idle and valid_objs and pspace_aligned and pspace_distinct and
            valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and
            not_idle_thread rcv and
            (\<lambda>s. (\<forall>x \<in> set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and>
                                 real_cte_at x s) \<and>
                 (\<forall>(cap, slot) \<in> set caps'. real_cte_at slot s \<and> valid_cap cap s \<and>
                       cte_wp_at (\<lambda>cp'. (cap \<noteq> cap.NullCap \<longrightarrow> cp'\<noteq>cap \<longrightarrow> cp' = masked_as_full cap cap )) slot s
                 )\<and>
            length dests \<le> 1 \<and>
            2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs)
           (Endpoint_D.transfer_caps_loop ep rcv caps dest)
           (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi)" proof (induct caps' arbitrary: mi n dests dest caps ep ep') case Nil thus ?case by clarsimp next case (Cons p caps' mi n dests) from Cons.prems show ?case apply (cases p) apply (rename_tac cap slot_ptr slot_idx) apply (clarsimp simp: const_on_failure_def split del: if_split) apply (case_tac "is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)") apply (subgoal_tac "Types_D.is_ep_cap (transform_cap cap) \<and>
                       (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))") prefer 2 apply (clarsimp simp: is_cap_simps cap_type_simps) apply (simp add: catch_liftE_bindE catch_liftE) apply (rule corres_guard_imp) apply (rule corres_split[where r'=dc]) apply (rule dcorres_set_extra_badge,simp) apply (rule Cons.hyps, rule refl, rule refl, simp) apply wp[1] apply (simp add: store_word_offs_def set_extra_badge_def
     not_idle_thread_def ipc_frame_wp_at_def
     split_def) apply (wp evalMonad_lookup_ipc_buffer_wp) apply (erule cte_wp_at_weakenE) apply (simp add:ipc_buffer_wp_at_def)+ apply wp apply ((wp hoare_vcg_ex_lift valid_irq_node_typ hoare_vcg_ball_lift)+)[3] apply simp subgoal by (fastforce simp: not_idle_thread_def ipc_frame_wp_at_def ipc_buffer_def) apply (subgoal_tac "\<not>(Types_D.is_ep_cap (transform_cap cap) \<and>
                       (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap)))") prefer 2 apply (clarsimp simp: is_cap_simps cap_type_simps split: cdl_cap.splits) apply (simp del: de_Morgan_conj split del: if_split) apply (case_tac dests) apply (simp add: dest_of_def returnOk_liftE catch_liftE) apply (case_tac list) prefer 2 apply simp apply (simp (no_asm_simp) add: dest_of_def split del: if_split) apply (subst bindE_assoc [symmetric]) apply (rule corres_guard_imp) apply (rule corres_split_catch [where f=dc and E="\<top>\<top>" and E'="\<top>\<top>"]; simp) apply (rule corres_splitEE) apply (subst alternative_bindE_distrib) apply simp apply (rule corres_alternate2) apply (rule derive_cap_dcorres [where P="\<top>"], simp) apply (rule corres_splitEE) apply (rule corres_whenE, simp) apply (rule dcorres_throw) apply (rule TrueI) apply (simp add: liftE_bindE) apply (rule corres_split) apply (rule dcorres_insert_cap_combine [folded alternative_com]) apply simp apply simp apply (rule Cons.hyps) apply (simp add: dest_of_def) apply (rule refl) apply (rule refl) apply wp[1] apply (simp add: split_def not_idle_thread_def) apply (wp evalMonad_lookup_ipc_buffer_wp ) apply (rule hoare_pre) apply (rule cap_insert_weak_cte_wp_at_not_null) apply clarsimp+ apply (wp cap_insert_idle valid_irq_node_typ hoare_vcg_ball_lift cap_insert_cte_wp_at)+ apply (simp add: if_apply_def2) apply wp apply (simp add: if_apply_def2) apply (rule validE_R_validE) apply (simp add:conj_comms ball_conj_distrib split del:if_split) apply (rule_tac Q' ="\<lambda>cap' s. (cap'\<noteq> cap.NullCap \<longrightarrow>(
       (cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s)
       \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s
       \<and> valid_mdb s \<and> QM s cap'))" for QM
       in hoare_post_imp_R) prefer 2 apply (rename_tac rv s) apply (subgoal_tac "rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s") apply (intro impI) apply simp apply (elim conjE) apply (erule conjE) apply simp apply (clarsimp simp:cte_wp_at_caps_of_state) apply (subst imp_conjR) apply (rule hoare_vcg_conj_liftE_R) apply (rule derive_cap_is_derived) apply (rule derive_cap_is_derived_foo) apply wp+ apply (simp split del: if_split) apply (clarsimp split del: if_split cong: conj_cong) apply (rule conjI) apply (clarsimp simp: valid_mdb_def mdb_cte_at_def cte_wp_at_caps_of_state) apply fast apply (rule conjI) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (rule conjI) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (case_tac "cap = capa") apply (clarsimp simp:cap_master_cap_simps remove_rights_def)+ apply (clarsimp simp:masked_as_full_def is_cap_simps cap_master_cap_def) apply (clarsimp split del: if_split) apply (clarsimp simp: cte_wp_at_caps_of_state not_idle_thread_def) apply (rule conjI) apply (clarsimp simp: not_idle_thread_def valid_idle_def pred_tcb_at_def
                         obj_at_def is_cap_table_def) apply (rule conjI) apply (clarsimp simp: not_idle_thread_def valid_idle_def pred_tcb_at_def
                         obj_at_def is_cap_table_def) apply (rule conjI) apply (clarsimp simp: not_idle_thread_def valid_idle_def pred_tcb_at_def
                         obj_at_def is_cap_table_def) apply (rule conjI) apply (rule rev_mp[OF _ real_cte_tcb_valid]) apply simp apply (rule context_conjI) apply (clarsimp split:if_split_asm simp:remove_rights_def) apply (intro conjI ballI) apply (drule(1) bspec,clarsimp)+ apply (case_tac "capb = aa") apply (clarsimp simp:masked_as_full_def split:if_split_asm) by (clarsimp simp:masked_as_full_def free_index_update_def is_cap_simps) qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi) proof (state)
goal (2 subgoals):
 1. \<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) []; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set []. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length [] < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n [] dests mi)
 2. \<And>a caps' mi n dests dest caps ep ep'. \<lbrakk>\<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi); dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) (a # caps'); ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (a # caps'). real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (a # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (a # caps') dests mi) proof (state)
this:
dest = dest_of dests
caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) []
ep = ep'

goal (2 subgoals):
 1. \<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) []; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set []. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length [] < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n [] dests mi)
 2. \<And>a caps' mi n dests dest caps ep ep'. \<lbrakk>\<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi); dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) (a # caps'); ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (a # caps'). real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (a # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (a # caps') dests mi) proof (prove)
using this:
dest = dest_of dests
caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) []
ep = ep'

goal (1 subgoal):
 1. dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length [] < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n [] dests mi) proof (state)
this:
dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length [] < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n [] dests mi)

goal (1 subgoal):
 1. \<And>a caps' mi n dests dest caps ep ep'. \<lbrakk>\<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi); dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) (a # caps'); ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (a # caps'). real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (a # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (a # caps') dests mi) proof (state)
goal (1 subgoal):
 1. \<And>a caps' mi n dests dest caps ep ep'. \<lbrakk>\<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi); dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) (a # caps'); ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (a # caps'). real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (a # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (a # caps') dests mi) proof (state)
this:
\<lbrakk>?dest = dest_of ?dests; ?caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps'; ?ep = ?ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set ?dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length ?dests \<le> 1 \<and> 2 + msg_max_length + ?n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ?ep rcv ?caps ?dest) (Ipc_A.transfer_caps_loop ?ep' rcv_buffer ?n caps' ?dests ?mi)
dest = dest_of dests
caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) (p # caps')
ep = ep'

goal (1 subgoal):
 1. \<And>a caps' mi n dests dest caps ep ep'. \<lbrakk>\<And>mi n dests dest caps ep ep'. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length caps' < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n caps' dests mi); dest = dest_of dests; caps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) (a # caps'); ep = ep'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (a # caps'). real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (a # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (a # caps') dests mi) proof (chain)
picking this:
dest = dest_of dests
caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) (p # caps')
ep = ep' proof (prove)
using this:
dest = dest_of dests
caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) (p # caps')
ep = ep'

goal (1 subgoal):
 1. dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (p # caps'). case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (p # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (p # caps') dests mi) proof (prove)
goal (1 subgoal):
 1. \<And>a b c. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) (p # caps'); ep = ep'; p = (a, b, c)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (p # caps'). case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (p # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (p # caps') dests mi) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) (p # caps'); ep = ep'; p = (cap, slot_ptr, slot_idx)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (p # caps'). case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (p # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (p # caps') dests mi) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (3 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap); Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)\<rbrakk> \<Longrightarrow> Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))
 3. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (3 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)\<rbrakk> \<Longrightarrow> Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap); Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 3. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap); Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (do y <- corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od) (do y <- set_extra_badge rcv_buffer (cap_ep_badge cap) n;
Ipc_A.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi))
od)
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (4 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (?Q21 cap slot_ptr slot_idx) (?Q'21 cap slot_ptr slot_idx) (do y <- corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od) (do y <- set_extra_badge rcv_buffer (cap_ep_badge cap) n;
Ipc_A.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi))
od)
 2. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ?Q21 cap slot_ptr slot_idx s
 3. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ?Q'21 cap slot_ptr slot_idx s
 4. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> dcorres dc (?P25 cap slot_ptr slot_idx) (?P'25 cap slot_ptr slot_idx) (corrupt_ipc_buffer rcv True) (set_extra_badge rcv_buffer (cap_ep_badge cap) n)
 2. \<And>cap slot_ptr slot_idx rv rv'. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (?R25 cap slot_ptr slot_idx rv) (?R'25 cap slot_ptr slot_idx rv') (Endpoint_D.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)) (Ipc_A.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
 3. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q25 cap slot_ptr slot_idx\<rbrace> corrupt_ipc_buffer rcv True \<lbrace>?R25 cap slot_ptr slot_idx\<rbrace>
 4. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> set_extra_badge rcv_buffer (cap_ep_badge cap) n \<lbrace>?R'25 cap slot_ptr slot_idx\<rbrace>
 5. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> (?P25 cap slot_ptr slot_idx and ?Q25 cap slot_ptr slot_idx) s
 6. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'25 cap slot_ptr slot_idx and ?Q'25 cap slot_ptr slot_idx) s
 7. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx rv rv'. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (?R25 cap slot_ptr slot_idx rv) (?R'25 cap slot_ptr slot_idx rv') (Endpoint_D.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)) (Ipc_A.transfer_caps_loop (Some (cap_object (transform_cap cap))) rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q25 cap slot_ptr slot_idx\<rbrace> corrupt_ipc_buffer rcv True \<lbrace>?R25 cap slot_ptr slot_idx\<rbrace>
 3. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> set_extra_badge rcv_buffer (cap_ep_badge cap) n \<lbrace>?R'25 cap slot_ptr slot_idx\<rbrace>
 4. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q25 cap slot_ptr slot_idx) s
 5. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 6. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q25 cap slot_ptr slot_idx\<rbrace> corrupt_ipc_buffer rcv True \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> set_extra_badge rcv_buffer (cap_ep_badge cap) n \<lbrace>\<lambda>rv'. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 3. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q25 cap slot_ptr slot_idx) s
 4. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 5. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (4 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> set_extra_badge rcv_buffer (cap_ep_badge cap) n \<lbrace>\<lambda>rv'. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 2. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 4. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (4 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> do s <- get;
y <- assert (in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s);
do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap))
od \<lbrace>\<lambda>rv' a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) a \<and> a \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a\<rbrace>
 2. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 3. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 4. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (8 subgoals):
 1. \<And>cap slot_ptr slot_idx s y P slot sa. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c; cte_wp_at (P and (\<noteq>) cap.NullCap) slot sa\<rbrakk> \<Longrightarrow> cte_wp_at P slot sa
 2. \<And>cap slot_ptr slot_idx s y buf t. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>ipc_buffer_wp_at buf t\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>r. ipc_buffer_wp_at buf t\<rbrace>
 3. \<And>cap slot_ptr slot_idx s y. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'58 cap slot_ptr slot_idx s y\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 4. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?B46 cap slot_ptr slot_idx s\<rbrace> assert (in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s) \<lbrace>\<lambda>y sa. valid_idle sa \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> evalMonad (lookup_ipc_buffer True rcv) sa = Some (Some rcv_buffer) \<and> ?P'58 cap slot_ptr slot_idx s y sa\<rbrace>
 5. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> get \<lbrace>?B46 cap slot_ptr slot_idx\<rbrace>
 6. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 7. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 8. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (8 subgoals):
 1. \<And>cap slot_ptr slot_idx s y P slot sa c. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c; (P and (\<noteq>) cap.NullCap) c\<rbrakk> \<Longrightarrow> P c
 2. \<And>cap slot_ptr slot_idx s y buf t. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>ipc_buffer_wp_at buf t\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>r. ipc_buffer_wp_at buf t\<rbrace>
 3. \<And>cap slot_ptr slot_idx s y. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'58 cap slot_ptr slot_idx s y\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 4. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?B46 cap slot_ptr slot_idx s\<rbrace> assert (in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s) \<lbrace>\<lambda>y sa. valid_idle sa \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> evalMonad (lookup_ipc_buffer True rcv) sa = Some (Some rcv_buffer) \<and> ?P'58 cap slot_ptr slot_idx s y sa\<rbrace>
 5. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> get \<lbrace>?B46 cap slot_ptr slot_idx\<rbrace>
 6. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 7. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 8. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx buf t. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> tcb_ipc_buffer tcb = buf) t\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>r. obj_at (\<lambda>ko. \<exists>tcb. ko = TCB tcb \<and> tcb_ipc_buffer tcb = buf) t\<rbrace>
 2. \<And>cap slot_ptr slot_idx s y. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'58 cap slot_ptr slot_idx s y\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 3. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?B46 cap slot_ptr slot_idx s\<rbrace> assert (in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s) \<lbrace>\<lambda>y sa. valid_idle sa \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> evalMonad (lookup_ipc_buffer True rcv) sa = Some (Some rcv_buffer) \<and> ?P'58 cap slot_ptr slot_idx s y sa\<rbrace>
 4. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> get \<lbrace>?B46 cap slot_ptr slot_idx\<rbrace>
 5. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 6. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 7. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx s y. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?P'58 cap slot_ptr slot_idx s y\<rbrace> do_machine_op (storeWord (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) (cap_ep_badge cap)) \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 2. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?B46 cap slot_ptr slot_idx s\<rbrace> assert (in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s) \<lbrace>\<lambda>y sa. valid_idle sa \<and> valid_objs sa \<and> pspace_aligned sa \<and> pspace_distinct sa \<and> valid_mdb sa \<and> evalMonad (lookup_ipc_buffer True rcv) sa = Some (Some rcv_buffer) \<and> ?P'58 cap slot_ptr slot_idx s y sa\<rbrace>
 3. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'25 cap slot_ptr slot_idx\<rbrace> get \<lbrace>?B46 cap slot_ptr slot_idx\<rbrace>
 4. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 5. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and ?Q'25 cap slot_ptr slot_idx) s
 6. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (3 subgoals):
 1. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>_. True)) s
 2. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and (\<lambda>s. in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s \<longrightarrow> valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>a. a = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s)) s
 3. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap)); p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)); obj_ref_of cap = cap_object (transform_cap cap); valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and (\<lambda>s. in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s \<longrightarrow> valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>a. a = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s)) s
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap_, transform_cslot_ptr (slot_ptr_, slot_idx_)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = Some (cap_object (transform_cap cap_)); p = (cap_, slot_ptr_, slot_idx_); Structures_A.is_ep_cap cap_ \<and> ep' = Some (cap_object (transform_cap cap_)); obj_ref_of cap_ = cap_object (transform_cap cap_); valid_idle s_ \<and> valid_objs s_ \<and> pspace_aligned s_ \<and> pspace_distinct s_ \<and> valid_mdb s_ \<and> evalMonad (lookup_ipc_buffer True rcv) s_ = Some (Some rcv_buffer) \<and> not_idle_thread rcv s_ \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s_ \<and> real_cte_at x s_) \<and> cap_table_at (length slot_idx_) slot_ptr_ s_ \<and> s_ \<turnstile> cap_ \<and> cte_wp_at (\<lambda>cp'. cap_ \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap_ \<longrightarrow> cp' = masked_as_full cap_ cap_) (slot_ptr_, slot_idx_) s_ \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s_ \<and> s_ \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s_) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s_\<rbrakk> \<Longrightarrow> (valid_idle and valid_objs and pspace_aligned and pspace_distinct and not_idle_thread rcv and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> 2 + msg_max_length + n < max_ipc_length) and valid_etcbs and (\<lambda>s. in_user_frame (rcv_buffer + (word_of_nat buffer_cptr_index + word_of_nat n) * word_of_nat word_size) s \<longrightarrow> valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>a. a = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>a. fst x \<noteq> cap.NullCap \<longrightarrow> a \<noteq> fst x \<longrightarrow> a = masked_as_full (fst x) (fst x)) (snd x) s) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s)) s_ proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap)))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> \<not> (Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap))\<rbrakk> \<Longrightarrow> \<not> (Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap)))
 2. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap)))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Types_D.is_ep_cap (transform_cap cap) \<and> (\<exists>z. ep' = Some z \<and> z = cap_object (transform_cap cap)))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)) then do corrupt_ipc_buffer rcv True;
Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') (dest_of dests)
od else if dest_of dests \<noteq> None then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap) then doE liftE $ set_extra_badge rcv_buffer (cap_ep_badge cap) n;
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' dests (MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || (1 << n)) (mi_label mi))
odE else if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap)))\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx a list aa lista. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = aa # lista\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a list aa lista. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = aa # lista\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>a. valid_idle a \<and> valid_objs a \<and> pspace_aligned a \<and> pspace_distinct a \<and> valid_mdb a \<and> evalMonad (lookup_ipc_buffer True rcv) a = Some (Some rcv_buffer) \<and> not_idle_thread rcv a \<and> (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x a \<and> real_cte_at x a) \<and> cap_table_at (length slot_idx) slot_ptr a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) a \<and> (\<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot a \<and> a \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot a) \<and> length dests \<le> Suc 0 \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs a) (if \<exists>a b. dest_of dests = Some (a, b) then doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
whenE (target_cap = cdl_cap.NullCap) throw;
liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (the (dest_of dests)));
liftE $ Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None
odE <catch> (\<lambda>_. return ()) else return ()) ((if dests \<noteq> [] then doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
whenE (cap' = cap.NullCap) $ throwError undefined;
liftE $ cap_insert cap' (slot_ptr, slot_idx) (hd dests);
liftE $ Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' (tl dests) mi
odE else returnOk (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>b. valid_idle b \<and> valid_objs b \<and> pspace_aligned b \<and> pspace_distinct b \<and> valid_mdb b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> not_idle_thread rcv b \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a b \<and> real_cte_at a b \<and> cap_table_at (length slot_idx) slot_ptr b \<and> b \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) b \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot b \<and> b \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot b) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs b) (doE new_cap <- returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap);
target_cap <- CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) new_cap;
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE <catch> (\<lambda>_. return ())) (doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (\<lambda>_. True) (\<lambda>b. valid_idle b \<and> valid_objs b \<and> pspace_aligned b \<and> pspace_distinct b \<and> valid_mdb b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> not_idle_thread rcv b \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a b \<and> real_cte_at a b \<and> cap_table_at (length slot_idx) slot_ptr b \<and> b \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) b \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot b \<and> b \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot b) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs b) (doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE <catch> (\<lambda>_. return ())) (doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) proof (prove)
goal (3 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []\<rbrakk> \<Longrightarrow> dcorres (\<lambda>_ _. True) (?Q114 cap slot_ptr slot_idx a list) (?Q'114 cap slot_ptr slot_idx a list) (doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE <catch> (\<lambda>_. return ())) (doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE <catch> (\<lambda>x. return (MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))))
 2. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ?Q114 cap slot_ptr slot_idx a list s
 3. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ?Q'114 cap slot_ptr slot_idx a list s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>_ _. True)) (?P119 cap slot_ptr slot_idx a []) (?P'119 cap slot_ptr slot_idx a []) (doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> (?P119 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'119 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (8 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'133 cap slot_ptr slot_idx a list) (?P144 cap slot_ptr slot_idx a []) (?P'140 cap slot_ptr slot_idx a []) ((returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx))) (CSpace_A.derive_cap (slot_ptr, slot_idx) cap)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; ?r'133 cap slot_ptr slot_idx a list target_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R133 cap slot_ptr slot_idx a list target_cap) (?R'133 cap slot_ptr slot_idx a list cap') (doE y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>?R133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>?R'133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> (?P144 cap slot_ptr slot_idx a list and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'140 cap slot_ptr slot_idx a list and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (8 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'152 cap cap slot_ptr slot_ptr slot_idx slot_idx a list (?a151 cap slot_ptr slot_idx a list) (?list151 cap slot_ptr slot_idx a list)) (?P151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) []) (?P'151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) []) (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<sqinter> returnOk (transform_cap cap) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx))) (CSpace_A.derive_cap (slot_ptr, slot_idx) cap)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; ?r'152 cap cap slot_ptr slot_ptr slot_idx slot_idx a list (?a151 cap slot_ptr slot_idx a list) (?list151 cap slot_ptr slot_idx a list) target_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R133 cap slot_ptr slot_idx a list target_cap) (?R'133 cap slot_ptr slot_idx a list cap') (doE y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>?R133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>?R'133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> (?P144 cap slot_ptr slot_idx a list and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'140 cap slot_ptr slot_idx a list and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s
flex-flex pairs:
\<lambda>cap slot_ptr slot_idx a list. ?P'151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a list. ?P'140 cap slot_ptr slot_idx a []
\<lambda>cap slot_ptr slot_idx a list. ?P151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a list. ?P144 cap slot_ptr slot_idx a [] proof (prove)
goal (8 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'152 cap cap slot_ptr slot_ptr slot_idx slot_idx a [] (?a151 cap slot_ptr slot_idx a []) (?list151 cap slot_ptr slot_idx a [])) (?P151 cap slot_ptr slot_idx a [] cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a []) []) (?P'151 cap slot_ptr slot_idx a [] cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a []) []) (CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cap cap)) (CSpace_A.derive_cap (slot_ptr, slot_idx) cap)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; ?r'152 cap cap slot_ptr slot_ptr slot_idx slot_idx a list (?a151 cap slot_ptr slot_idx a list) (?list151 cap slot_ptr slot_idx a list) target_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R133 cap slot_ptr slot_idx a list target_cap) (?R'133 cap slot_ptr slot_idx a list cap') (doE y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>?R133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>?R'133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> (?P144 cap slot_ptr slot_idx a list and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'140 cap slot_ptr slot_idx a list and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s
flex-flex pairs:
\<lambda>cap slot_ptr slot_idx a list. ?P'151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a list. ?P'140 cap slot_ptr slot_idx a []
\<lambda>cap slot_ptr slot_idx a list. ?P151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a list. ?P144 cap slot_ptr slot_idx a [] proof (prove)
goal (8 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'152 cap cap slot_ptr slot_ptr slot_idx slot_idx a [] (?a151 cap slot_ptr slot_idx a []) (?list151 cap slot_ptr slot_idx a [])) (?P151 cap slot_ptr slot_idx a [] cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a []) []) (?P'151 cap slot_ptr slot_idx a [] cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a []) []) (CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cap cap)) (CSpace_A.derive_cap (slot_ptr, slot_idx) cap)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; ?r'152 cap cap slot_ptr slot_ptr slot_idx slot_idx a list (?a151 cap slot_ptr slot_idx a list) (?list151 cap slot_ptr slot_idx a list) target_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R133 cap slot_ptr slot_idx a list target_cap) (?R'133 cap slot_ptr slot_idx a list cap') (doE y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>?R133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>?R'133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> (?P144 cap slot_ptr slot_idx a list and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> (?P'140 cap slot_ptr slot_idx a list and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s
flex-flex pairs:
\<lambda>cap slot_ptr slot_idx a list. ?P'151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a list. ?P'140 cap slot_ptr slot_idx a []
\<lambda>cap slot_ptr slot_idx a list. ?P151 cap slot_ptr slot_idx a list cap slot_ptr slot_idx (?a151 cap slot_ptr slot_idx a list) [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a list. ?P144 cap slot_ptr slot_idx a [] proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R133 cap slot_ptr slot_idx a list target_cap) (?R'133 cap slot_ptr slot_idx a list cap') (doE y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>?R133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>?R'133 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (10 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'161 cap slot_ptr slot_idx a list target_cap cap') (?P162 cap slot_ptr slot_idx a list target_cap) (?P'164 cap slot_ptr slot_idx a list cap') (whenE (target_cap = cdl_cap.NullCap) throw) (whenE (cap' = cap.NullCap) (throwError undefined))
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' rv rv'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; ?r'161 cap slot_ptr slot_idx a list target_cap cap' rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R161 cap slot_ptr slot_idx a list target_cap cap' rv) (?R'161 cap slot_ptr slot_idx a list target_cap cap' rv') (doE y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>?R161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>?R'161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. ?P162 cap slot_ptr slot_idx a list target_cap and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. ?P'164 cap slot_ptr slot_idx a list cap' and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (11 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'161 cap slot_ptr slot_idx a list target_cap cap') (?P172 cap slot_ptr slot_idx a list target_cap) (?P'174 cap slot_ptr slot_idx a list cap') throw (throwError undefined)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> ?r'161 cap slot_ptr slot_idx a list target_cap cap' () ()
 3. \<And>cap slot_ptr slot_idx a list target_cap cap' rv rv'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; ?r'161 cap slot_ptr slot_idx a list target_cap cap' rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R161 cap slot_ptr slot_idx a list target_cap cap' rv) (?R'161 cap slot_ptr slot_idx a list target_cap cap' rv') (doE y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>?R161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>?R'161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> ?P172 cap slot_ptr slot_idx a list target_cap s) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> ?P'174 cap slot_ptr slot_idx a list cap' s) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> ?r'161 cap slot_ptr slot_idx a list target_cap cap' () ()
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' rv rv'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; ?r'161 cap slot_ptr slot_idx a list target_cap cap' rv rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R161 cap slot_ptr slot_idx a list target_cap cap' rv) (?R'161 cap slot_ptr slot_idx a list target_cap cap' rv') (doE y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>?R161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>?R'161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (9 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap' rv rv'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; True\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a b. True)) (?R161 cap slot_ptr slot_idx a list target_cap cap' rv) (?R'161 cap slot_ptr slot_idx a list target_cap cap' rv') (doE y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE) (doE y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>?R161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>?R'161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (9 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R161 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()) (?R'161 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()) (do y <- insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a);
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
od) (do y <- cap_insert cap' (slot_ptr, slot_idx) a;
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
od)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>?R161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>?R'161 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (12 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres (?r'179 cap slot_ptr slot_idx a list target_cap cap') (?P190 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()) (?P'186 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()) (insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a)) (cap_insert cap' (slot_ptr, slot_idx) a)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' y ya. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; ?r'179 cap slot_ptr slot_idx a list target_cap cap' y ya\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R179 cap slot_ptr slot_idx a list target_cap cap' y) (?R'179 cap slot_ptr slot_idx a list target_cap cap' ya) (liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)) (liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi))
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>?R179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>?R'179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. ?P190 cap slot_ptr slot_idx a list target_cap cap' b and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. ?P'186 cap slot_ptr slot_idx a list target_cap cap' b and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> transform_cap cap' = transform_cap cap'
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' y ya. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; dc y ya\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R179 cap slot_ptr slot_idx a list target_cap cap' y) (?R'179 cap slot_ptr slot_idx a list target_cap cap' ya) (liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)) (liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi))
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>?R179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>?R'179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap' y ya. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; dc y ya\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>a b. True)) (?R179 cap slot_ptr slot_idx a list target_cap cap' y) (?R'179 cap slot_ptr slot_idx a list target_cap cap' ya) (liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps') None)) (liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi))
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>?R179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>?R'179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> dcorres (\<lambda>a b. True) (?R179 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()) (?R'179 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()) (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None) (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>?R179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>?R'179 cap slot_ptr slot_idx a list target_cap cap'\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> None = dest_of []
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps' = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps'
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> ep' = ep'
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>a. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set list. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length list \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps' = map (\<lambda>a. case a of (cap, slot) \<Rightarrow> (transform_cap cap, transform_cslot_ptr slot)) caps'
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> ep' = ep'
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>a. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set list. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length list \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> ep' = ep'
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>a. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set list. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length list \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> insert_cap_child (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling (transform_cap cap') (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>a. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set list. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length list \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>b. (\<lambda>a. True) and ?Q188 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (9 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>a. valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set list. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set caps'. case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length list \<le> 1 \<and> 2 + msg_max_length + Suc n + length caps' < max_ipc_length) and valid_etcbs\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (9 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'184 cap slot_ptr slot_idx a [] (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>a b. valid_idle b \<and> valid_objs b \<and> pspace_aligned b \<and> pspace_distinct b \<and> valid_mdb b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread b \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) b \<and> b \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) b) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs b\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and ?Q'184 cap slot_ptr slot_idx a list target_cap cap' b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (11 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap' P slot. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c\<rbrakk> \<Longrightarrow> \<lbrace>cte_wp_at (P and (\<noteq>) cap.NullCap) slot\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>r. cte_wp_at P slot\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' buf t. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>ipc_buffer_wp_at buf t\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>r. ipc_buffer_wp_at buf t\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'247 cap slot_ptr slot_idx a (ds_id []) (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>c. valid_idle c \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) c \<and> pspace_aligned c \<and> pspace_distinct c \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) c \<and> evalMonad (lookup_ipc_buffer True rcv) c = Some (Some rcv_buffer) \<and> ?P'247 cap slot_ptr slot_idx a list target_cap cap' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap' P slot. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c\<rbrakk> \<Longrightarrow> \<lbrace>?Q253 cap slot_ptr slot_idx a list target_cap cap' P slot\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>r. cte_wp_at P slot\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' P slot s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c; cte_wp_at (P and (\<noteq>) cap.NullCap) slot s\<rbrakk> \<Longrightarrow> ?Q253 cap slot_ptr slot_idx a list target_cap cap' P slot s
 3. \<And>cap slot_ptr slot_idx a list target_cap cap' buf t. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>ipc_buffer_wp_at buf t\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>r. ipc_buffer_wp_at buf t\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'247 cap slot_ptr slot_idx a (ds_id []) (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>c. valid_idle c \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) c \<and> pspace_aligned c \<and> pspace_distinct c \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) c \<and> evalMonad (lookup_ipc_buffer True rcv) c = Some (Some rcv_buffer) \<and> ?P'247 cap slot_ptr slot_idx a list target_cap cap' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap slot_ptr slot_idx a list target_cap cap' P slot c. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c; P c\<rbrakk> \<Longrightarrow> \<not> Structures_A.is_untyped_cap c
 2. \<And>cap slot_ptr slot_idx a list target_cap cap' P slot s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'; \<And>c. P c \<Longrightarrow> \<not> Structures_A.is_untyped_cap c; cte_wp_at (P and (\<noteq>) cap.NullCap) slot s\<rbrakk> \<Longrightarrow> cte_wp_at (P and (\<noteq>) cap.NullCap) slot s
 3. \<And>cap slot_ptr slot_idx a list target_cap cap' buf t. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>ipc_buffer_wp_at buf t\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>r. ipc_buffer_wp_at buf t\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'247 cap slot_ptr slot_idx a (ds_id []) (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>c. valid_idle c \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) c \<and> pspace_aligned c \<and> pspace_distinct c \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) c \<and> evalMonad (lookup_ipc_buffer True rcv) c = Some (Some rcv_buffer) \<and> ?P'247 cap slot_ptr slot_idx a list target_cap cap' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap slot_ptr slot_idx a b cap' buf t. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]\<rbrakk> \<Longrightarrow> \<lbrace>ipc_buffer_wp_at buf t\<rbrace> cap_insert cap' (slot_ptr, slot_idx) (a, b) \<lbrace>\<lambda>r. ipc_buffer_wp_at buf t\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>p. (transform_cap (fst p), transform_cslot_ptr (snd p))) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?P'247 cap slot_ptr slot_idx a (ds_id []) (transform_cap cap') cap' ()\<rbrace> cap_insert cap' (slot_ptr, slot_idx) a \<lbrace>\<lambda>rv s. rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace> whenE (target_cap = cdl_cap.NullCap) throw \<lbrace>\<lambda>a. (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list target_cap cap'. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; target_cap = transform_cap cap'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>b. (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>c. valid_idle c \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) c \<and> pspace_aligned c \<and> pspace_distinct c \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) c \<and> evalMonad (lookup_ipc_buffer True rcv) c = Some (Some rcv_buffer) \<and> ?P'247 cap slot_ptr slot_idx a list target_cap cap' b c)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q142 cap slot_ptr slot_idx a []\<rbrace> (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) \<lbrace>\<lambda>target_cap. (\<lambda>s. target_cap = cdl_cap.NullCap \<longrightarrow> True) and ?Q163 cap slot_ptr slot_idx a list target_cap\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q'165 cap slot_ptr slot_idx a list cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?Q142 cap slot_ptr slot_idx a list and ?Q119 cap slot_ptr slot_idx a list) s
 10. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list x. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?B345 cap slot_ptr slot_idx a list x\<rbrace> CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx)) x \<lbrace>\<lambda>target_cap s. (target_cap = cdl_cap.NullCap \<longrightarrow> True) \<and> True \<and> (if target_cap = cdl_cap.NullCap then \<lambda>a. True \<and> True else (\<lambda>a. True) and ((\<lambda>a. True) and (\<lambda>a. True))) s\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?P'338 cap slot_ptr slot_idx a (ds_id [])\<rbrace> returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap) \<lbrace>?B345 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (if cap' = cap.NullCap then \<lambda>a. True \<and> True else (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>b. valid_idle b \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) b \<and> pspace_aligned b \<and> pspace_distinct b \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread b \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) b \<and> b \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt b) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) b \<and> valid_mdb b \<and> valid_objs b \<and> (if snd x = a then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) b)) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs b)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>b. True \<and> ?P'338 cap slot_ptr slot_idx a list b) and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?P'338 cap slot_ptr slot_idx a (ds_id [])\<rbrace> returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap) \<lbrace>?B345 cap slot_ptr slot_idx a list\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (if cap' = cap.NullCap then \<lambda>a. True \<and> True else (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>b. valid_idle b \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) b \<and> pspace_aligned b \<and> pspace_distinct b \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread b \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) b \<and> b \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt b) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) b \<and> valid_mdb b \<and> valid_objs b \<and> (if snd x = a then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) b)) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs b)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>b. True \<and> ?P'338 cap slot_ptr slot_idx a list b) and ?Q119 cap slot_ptr slot_idx a list) s
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (if cap' = cap.NullCap then \<lambda>a. True \<and> True else (\<lambda>b. cte_wp_at ((=) cap.NullCap) a b \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> not_idle_thread (fst a) b \<and> not_idle_thread (fst (slot_ptr, slot_idx)) b \<and> valid_mdb b \<and> valid_idle b \<and> valid_etcbs b \<and> valid_objs b \<and> cap_aligned cap') and (\<lambda>b. valid_idle b \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' a) b \<and> pspace_aligned b \<and> pspace_distinct b \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) and K ((slot_ptr, slot_idx) \<noteq> a)) b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread b \<and> (\<forall>x\<in>set caps'. real_cte_at (snd x) b \<and> b \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt b) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) b \<and> valid_mdb b \<and> valid_objs b \<and> (if snd x = a then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) b)) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs b)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap.NullCap) a s \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> not_idle_thread (fst a) s \<and> not_idle_thread slot_ptr s \<and> valid_mdb s \<and> valid_idle s \<and> valid_etcbs s \<and> valid_objs s \<and> cap_aligned cap' \<and> valid_idle s \<and> valid_objs s \<and> s \<turnstile> cap' \<and> tcb_cap_valid cap' a s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> s \<turnstile> cap' \<and> valid_objs s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set caps'. (snd x = a \<longrightarrow> real_cte_at a s \<and> s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> valid_mdb s \<and> valid_objs s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (snd x \<noteq> a \<longrightarrow> real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> valid_mdb s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((=) cap.NullCap) a s \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> not_idle_thread (fst a) s \<and> not_idle_thread slot_ptr s \<and> valid_mdb s \<and> valid_idle s \<and> valid_etcbs s \<and> valid_objs s \<and> cap_aligned cap' \<and> valid_idle s \<and> valid_objs s \<and> s \<turnstile> cap' \<and> tcb_cap_valid cap' a s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> s \<turnstile> cap' \<and> valid_objs s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> rcv \<noteq> idle_thread s \<and> (\<forall>x\<in>set caps'. (snd x = a \<longrightarrow> real_cte_at a s \<and> s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> valid_mdb s \<and> valid_objs s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (snd x \<noteq> a \<longrightarrow> real_cte_at (snd x) s \<and> s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> valid_mdb s \<and> valid_objs s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned cap' \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> cap' \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid cap' a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a [] s rv; cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s; rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s; rv \<noteq> cap.NullCap; cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s; pspace_aligned s; pspace_distinct s; valid_objs s; valid_idle s; valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a [] s rv\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM436 cap slot_ptr slot_idx a list s cap'\<rbrace>, -
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (7 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s; rv \<noteq> cap.NullCap; cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s; pspace_aligned s; pspace_distinct s; valid_objs s; valid_idle s; valid_mdb s; ?QM447 cap slot_ptr slot_idx a [] rv s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> cap_aligned rv \<and> valid_idle s \<and> valid_mdb s \<and> valid_objs s \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at a s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> valid_mdb s \<and> valid_objs s \<and> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM447 cap slot_ptr slot_idx a list rv s\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> ?QM447 cap slot_ptr slot_idx a list cap' s\<rbrace>, -
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 7. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx a list rv s. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> cap_aligned rv \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at a s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (slot_ptr, slot_idx) s
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> cap' \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid cap' a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at a s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrace>, -
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'138 cap slot_ptr slot_idx a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> cap' \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid cap' a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at a s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'488 cap cap slot_ptr slot_ptr slot_idx slot_idx a a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>cap' s. (cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) cap') (slot_ptr, slot_idx) s) \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> cap' \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid cap' a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at a s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s))\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ?Q'138 cap slot_ptr slot_idx a list and ?Q'119 cap slot_ptr slot_idx a list) s
flex-flex pairs:
\<lambda>cap slot_ptr slot_idx a. ?Q'488 cap cap slot_ptr slot_ptr slot_idx slot_idx a a [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a. ?Q'138 cap slot_ptr slot_idx a [] proof (prove)
goal (6 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?P497 cap cap slot_ptr slot_ptr slot_idx slot_idx a a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>rv s. rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (slot_ptr, slot_idx) rv) (slot_ptr, slot_idx) s\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 cap cap slot_ptr slot_ptr slot_idx slot_idx a a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>rv s. rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> cap_aligned rv \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at a s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrace>, -
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 6. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and (?P500 cap slot_ptr slot_idx a list and ?Q499 cap slot_ptr slot_idx a list) and ?Q'119 cap slot_ptr slot_idx a list) s
flex-flex pairs:
\<lambda>cap slot_ptr slot_idx a. ?P500 cap slot_ptr slot_idx a [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a. ?P497 cap cap slot_ptr slot_ptr slot_idx slot_idx a a []
\<lambda>cap slot_ptr slot_idx a. ?Q499 cap slot_ptr slot_idx a [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a. ?Q495 cap cap slot_ptr slot_ptr slot_idx slot_idx a a [] proof (prove)
goal (5 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q495 cap cap slot_ptr slot_ptr slot_idx slot_idx a a []\<rbrace> CSpace_A.derive_cap (slot_ptr, slot_idx) cap \<lbrace>\<lambda>rv s. rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_idle s \<and> valid_mdb s \<and> cap_aligned rv \<and> not_idle_thread slot_ptr s \<and> s \<turnstile> rv \<and> not_idle_thread (fst a) s \<and> tcb_cap_valid rv a s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) a s \<and> valid_etcbs s \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at a s \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrace>, -
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 5. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ((\<lambda>a. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) a \<and> valid_objs a) and ?Q499 cap slot_ptr slot_idx a list) and ?Q'119 cap slot_ptr slot_idx a list) s
flex-flex pairs:
\<lambda>cap slot_ptr slot_idx a. ?Q499 cap slot_ptr slot_idx a [] \<equiv>\<^sup>? \<lambda>cap slot_ptr slot_idx a. ?Q495 cap cap slot_ptr slot_ptr slot_idx slot_idx a a [] proof (prove)
goal (4 subgoals):
 1. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q119 cap slot_ptr slot_idx a []\<rbrace> doE target_cap <- (returnOk (update_cap_rights (Types_D.cap_rights (transform_cap cap) - {AllowWrite}) (transform_cap cap)) \<sqinter> returnOk (transform_cap cap)) >>=E CSpace_D.derive_cap (transform_cslot_ptr (slot_ptr, slot_idx));
y <- whenE (target_cap = cdl_cap.NullCap) throw;
y <- liftE (insert_cap_child target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a) \<sqinter> insert_cap_sibling target_cap (transform_cslot_ptr (slot_ptr, slot_idx)) (transform_cslot_ptr a));
liftE (Endpoint_D.transfer_caps_loop ep' rcv (map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps') None)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>cap slot_ptr slot_idx a list. \<lbrakk>dest = dest_of [a]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [a]; list = []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'119 cap slot_ptr slot_idx a []\<rbrace> doE cap' <- CSpace_A.derive_cap (slot_ptr, slot_idx) cap;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (slot_ptr, slot_idx) a);
liftE (Ipc_A.transfer_caps_loop ep' rcv_buffer (Suc n) caps' [] mi)
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and ?Q119 cap slot_ptr slot_idx a list) s
 4. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ((\<lambda>a. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) a \<and> valid_objs a) and (\<lambda>b. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) b \<and> valid_objs b \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b) \<and> (b \<turnstile> cap \<longrightarrow> b \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned b \<and> pspace_distinct b \<and> valid_objs b \<and> valid_idle b \<and> valid_mdb b \<and> cap_aligned cap' \<and> not_idle_thread slot_ptr b \<and> b \<turnstile> cap' \<and> not_idle_thread (fst a) b \<and> tcb_cap_valid cap' a b \<and> rcv \<noteq> idle_thread b \<and> cte_wp_at ((=) cap.NullCap) a b \<and> valid_etcbs b \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> b \<turnstile> fst x \<and> real_cte_at a b \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> b \<turnstile> fst x \<and> real_cte_at (snd x) b \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) b))) and ?Q'119 cap slot_ptr slot_idx a list) s proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; True\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> True \<and> ((\<lambda>a. True \<and> True) and (\<lambda>a. True \<and> True)) a) and (\<lambda>a. True \<and> True)) s
 2. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ((\<lambda>a. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) a \<and> valid_objs a) and (\<lambda>b. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) b \<and> valid_objs b \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b) \<and> (b \<turnstile> cap \<longrightarrow> b \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned b \<and> pspace_distinct b \<and> valid_objs b \<and> valid_idle b \<and> valid_mdb b \<and> cap_aligned cap' \<and> not_idle_thread slot_ptr b \<and> b \<turnstile> cap' \<and> not_idle_thread (fst a) b \<and> tcb_cap_valid cap' a b \<and> rcv \<noteq> idle_thread b \<and> cte_wp_at ((=) cap.NullCap) a b \<and> valid_etcbs b \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> b \<turnstile> fst x \<and> real_cte_at a b \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> b \<turnstile> fst x \<and> real_cte_at (snd x) b \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) b))) and (\<lambda>a. True \<and> True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a list s. \<lbrakk>dest = dest_of dests; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (obj_ref_of cap)); \<not> (Structures_A.is_ep_cap cap \<and> ep' = Some (cap_object (transform_cap cap))); dests = a # list; list = []; valid_idle s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer) \<and> not_idle_thread rcv s \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) a s \<and> real_cte_at a s \<and> cap_table_at (length slot_idx) slot_ptr s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s \<and> (\<forall>(cap, slot)\<in>set caps'. real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> valid_etcbs s\<rbrakk> \<Longrightarrow> ((\<lambda>a. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) a) and ((\<lambda>a. cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) a \<and> valid_objs a) and (\<lambda>b. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) b \<and> valid_objs b \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b) \<and> (b \<turnstile> cap \<longrightarrow> b \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned b \<and> pspace_distinct b \<and> valid_objs b \<and> valid_idle b \<and> valid_mdb b \<and> cap_aligned cap' \<and> not_idle_thread slot_ptr b \<and> b \<turnstile> cap' \<and> not_idle_thread (fst a) b \<and> tcb_cap_valid cap' a b \<and> rcv \<noteq> idle_thread b \<and> cte_wp_at ((=) cap.NullCap) a b \<and> valid_etcbs b \<and> (slot_ptr, slot_idx) \<noteq> a \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) b \<and> evalMonad (lookup_ipc_buffer True rcv) b = Some (Some rcv_buffer) \<and> Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length \<and> (\<forall>x\<in>set caps'. snd x = a \<longrightarrow> b \<turnstile> fst x \<and> real_cte_at a b \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> a \<longrightarrow> b \<turnstile> fst x \<and> real_cte_at (snd x) b \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) b))) and (\<lambda>a. True \<and> True)) s proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>a. cte_wp_at (\<lambda>_. True) a s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> (cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>a. cte_wp_at (\<lambda>_. True) a s) (cdt s)
 2. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> (cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s capa aa ba ab bb. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> cap.NullCap \<noteq> cap) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap); caps_of_state s (slot_ptr, slot_idx) = Some capa; cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); cdt s (ab, bb) = Some (aa, ba)\<rbrakk> \<Longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap) \<and> (\<exists>cap. caps_of_state s (ab, bb) = Some cap)
 2. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> (cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s \<and> (cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (slot_ptr, slot_idx) s
 2. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> (cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> (cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> cap \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap) (slot_ptr, slot_idx) s
 2. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> \<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; caps_of_state s (slot_ptr, slot_idx) = Some capa; cap \<noteq> cap.NullCap; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap
 2. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> \<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s) proof (prove)
goal (3 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; caps_of_state s (slot_ptr, slot_idx) = Some capa; cap \<noteq> cap.NullCap; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; cap = capa\<rbrakk> \<Longrightarrow> cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap
 2. \<And>cap slot_ptr slot_idx a b s capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; caps_of_state s (slot_ptr, slot_idx) = Some capa; cap \<noteq> cap.NullCap; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; cap \<noteq> capa\<rbrakk> \<Longrightarrow> cap_master_cap capa = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge capa, CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid cap \<and> vs_cap_ref capa = vs_cap_ref cap
 3. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> \<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; caps_of_state s (slot_ptr, slot_idx) = Some (masked_as_full cap cap); cap \<noteq> cap.NullCap; cap \<noteq> masked_as_full cap cap\<rbrakk> \<Longrightarrow> cap_master_cap (masked_as_full cap cap) = cap_master_cap cap \<and> (CSpaceInv_AI.cap_badge (masked_as_full cap cap), CSpaceInv_AI.cap_badge cap) \<in> capBadge_ordering False
 2. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> \<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s\<rbrakk> \<Longrightarrow> \<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> cap.NullCap \<and> \<not> is_zombie cap \<and> cap \<noteq> IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap'. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); not_idle_thread rcv s; cte_wp_at (\<lambda>cap. cap = cap.NullCap) (a, b) s; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; cte_wp_at (\<lambda>cp'. cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) (slot_ptr, slot_idx) s; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap\<rbrakk> \<Longrightarrow> cap_aligned cap' \<and> not_idle_thread slot_ptr s \<and> not_idle_thread a s \<and> tcb_cap_valid cap' (a, b) s \<and> rcv \<noteq> idle_thread s \<and> cte_wp_at ((=) cap.NullCap) (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> cap_aligned cap' \<and> slot_ptr \<noteq> idle_thread s \<and> a \<noteq> idle_thread s \<and> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> cap_aligned cap'
 2. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> slot_ptr \<noteq> idle_thread s \<and> a \<noteq> idle_thread s \<and> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> slot_ptr \<noteq> idle_thread s \<and> a \<noteq> idle_thread s \<and> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> slot_ptr \<noteq> idle_thread s
 2. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s
 2. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> tcb_cap_valid cap' (a, b) s \<and> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> tcb_cap_valid cap' (a, b) s
 2. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> real_cte_at (a, b) s
 2. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> (slot_ptr = a \<longrightarrow> slot_idx \<noteq> b) \<and> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap\<rbrakk> \<Longrightarrow> slot_ptr = a \<longrightarrow> slot_idx \<noteq> b
 2. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set caps'. snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))) \<and> (\<forall>x\<in>set caps'. snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa x. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b; x \<in> set caps'\<rbrakk> \<Longrightarrow> snd x = (a, b) \<longrightarrow> s \<turnstile> fst x \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x))
 2. \<And>cap slot_ptr slot_idx a b s cap' capa x. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; \<forall>x\<in>set caps'. case x of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> (\<exists>capa. caps_of_state s slot = Some capa \<and> (cap \<noteq> cap.NullCap \<longrightarrow> capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap)); Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b; x \<in> set caps'\<rbrakk> \<Longrightarrow> snd x \<noteq> (a, b) \<longrightarrow> s \<turnstile> fst x \<and> real_cte_at (snd x) s \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))) proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa aa ab ba capb. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b; (aa, ab, ba) \<in> set caps'; cap_table_at (length ba) ab s; s \<turnstile> aa; caps_of_state s (ab, ba) = Some capb; ab = a \<longrightarrow> ba \<noteq> b; aa \<noteq> cap.NullCap; masked_as_full capb cap' \<noteq> aa; capb \<noteq> aa \<longrightarrow> capb = masked_as_full aa aa\<rbrakk> \<Longrightarrow> masked_as_full capb cap' = masked_as_full aa aa proof (prove)
goal (2 subgoals):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa aa ab ba capb. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b; (aa, ab, ba) \<in> set caps'; cap_table_at (length ba) ab s; s \<turnstile> aa; caps_of_state s (ab, ba) = Some capb; ab = a \<longrightarrow> ba \<noteq> b; aa \<noteq> cap.NullCap; masked_as_full capb cap' \<noteq> aa; capb \<noteq> aa \<longrightarrow> capb = masked_as_full aa aa; capb = aa\<rbrakk> \<Longrightarrow> masked_as_full capb cap' = masked_as_full aa aa
 2. \<And>cap slot_ptr slot_idx a b s cap' capa aa ab ba capb. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b; (aa, ab, ba) \<in> set caps'; cap_table_at (length ba) ab s; s \<turnstile> aa; caps_of_state s (ab, ba) = Some capb; ab = a \<longrightarrow> ba \<noteq> b; aa \<noteq> cap.NullCap; masked_as_full capb cap' \<noteq> aa; capb \<noteq> aa \<longrightarrow> capb = masked_as_full aa aa; capb \<noteq> aa\<rbrakk> \<Longrightarrow> masked_as_full capb cap' = masked_as_full aa aa proof (prove)
goal (1 subgoal):
 1. \<And>cap slot_ptr slot_idx a b s cap' capa aa ab ba capb. \<lbrakk>dest = dest_of [(a, b)]; caps = (transform_cap cap, transform_cslot_ptr (slot_ptr, slot_idx)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) caps'; ep = ep'; p = (cap, slot_ptr, slot_idx); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (obj_ref_of cap); Structures_A.is_ep_cap cap \<longrightarrow> ep' \<noteq> Some (cap_object (transform_cap cap)); dests = [(a, b)]; valid_idle s; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer); rcv \<noteq> idle_thread s; caps_of_state s (a, b) = Some cap.NullCap; cap_table_at (length b) a s; cap_table_at (length slot_idx) slot_ptr s; s \<turnstile> cap; Suc (Suc (Suc (msg_max_length + n + length caps'))) < max_ipc_length; valid_etcbs s; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; cap \<noteq> cap.NullCap; \<not> is_zombie cap; cap \<noteq> IRQControlCap; caps_of_state s (slot_ptr, slot_idx) = Some capa; capa \<noteq> cap \<longrightarrow> capa = masked_as_full cap cap; slot_ptr = a \<longrightarrow> slot_idx \<noteq> b; (aa, ab, ba) \<in> set caps'; cap_table_at (length ba) ab s; s \<turnstile> aa; caps_of_state s (ab, ba) = Some capb; ab = a \<longrightarrow> ba \<noteq> b; aa \<noteq> cap.NullCap; masked_as_full capb cap' \<noteq> aa; capb \<noteq> aa \<longrightarrow> capb = masked_as_full aa aa; capb \<noteq> aa\<rbrakk> \<Longrightarrow> masked_as_full capb cap' = masked_as_full aa aa proof (state)
this:
dcorres (\<lambda>_ _. True) (\<lambda>_. True) (valid_idle and valid_objs and pspace_aligned and pspace_distinct and valid_mdb and (\<lambda>s. evalMonad (lookup_ipc_buffer True rcv) s = Some (Some rcv_buffer)) and not_idle_thread rcv and (\<lambda>s. (\<forall>x\<in>set dests. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (p # caps'). case a of (cap, slot) \<Rightarrow> real_cte_at slot s \<and> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> length dests \<le> 1 \<and> 2 + msg_max_length + n + length (p # caps') < max_ipc_length) and valid_etcbs) (Endpoint_D.transfer_caps_loop ep rcv caps dest) (Ipc_A.transfer_caps_loop ep' rcv_buffer n (p # caps') dests mi)

goal:
No subgoals!