theory Ipc_R

lemma transferCapsToSlots_corres:
  "\<lbrakk> list_all2 (\<lambda>(cap, slot) (cap', slot'). cap_relation cap cap'
             \<and> slot' = cte_map slot) caps caps';
      mi' = message_info_map mi \<rbrakk> \<Longrightarrow>
   corres ((=) \<circ> message_info_map)
      (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s
         \<and> valid_list s
         \<and> (case ep of Some x \<Rightarrow> ep_at x s | _ \<Rightarrow> True)
         \<and> (\<forall>x \<in> set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and>
                             real_cte_at x s)
         \<and> (\<forall>(cap, slot) \<in> set caps. valid_cap cap s \<and>
                    cte_wp_at (\<lambda>cp'. (cap \<noteq> cap.NullCap \<longrightarrow> cp'\<noteq>cap \<longrightarrow> cp' = masked_as_full cap cap )) slot s )
         \<and> distinct slots
         \<and> in_user_frame buffer s)
      (\<lambda>s. valid_pspace' s
         \<and> (case ep of Some x \<Rightarrow> ep_at' x s | _ \<Rightarrow> True)
         \<and> (\<forall>x \<in> set (map cte_map slots).
             cte_wp_at' (\<lambda>cte. cteCap cte = NullCap) x s
                   \<and> real_cte_at' x s)
         \<and> distinct (map cte_map slots)
         \<and> valid_ipc_buffer_ptr' buffer s
         \<and> (\<forall>(cap, slot) \<in> set caps'. valid_cap' cap s \<and>
                    cte_wp_at' (\<lambda>cte. cap \<noteq> NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s)
         \<and> 2 + msg_max_length + n + length caps' < unat max_ipc_words)
      (transfer_caps_loop ep buffer n caps slots mi)
      (transferCapsToSlots ep buffer n caps'
         (map cte_map slots) mi')"
  (is "\<lbrakk> list_all2 ?P caps caps'; ?v \<rbrakk> \<Longrightarrow> ?corres") proof (induct caps caps' arbitrary: slots n mi mi' rule: list_all2_induct) case Nil show ?case using Nil.prems by (case_tac mi, simp) next case (Cons x xs y ys slots n mi mi') note if_weak_cong[cong] if_cong [cong del] assume P: "?P x y" show ?case using Cons.prems P apply (clarsimp split del: if_split) apply (simp add: Let_def split_def word_size liftE_bindE
                     word_bits_conv[symmetric] split del: if_split) apply (rule corres_const_on_failure) apply (simp add: dc_def[symmetric] split del: if_split) apply (rule corres_guard_imp) apply (rule corres_if2) apply (case_tac "fst x", auto simp add: isCap_simps)[1] apply (rule corres_split[OF corres_set_extra_badge]) apply (clarsimp simp: is_cap_simps) apply (drule conjunct1) apply simp apply (rule corres_rel_imp, rule Cons.hyps, simp_all)[1] apply (case_tac mi, simp) apply (simp add: split_def) apply (wp hoare_vcg_const_Ball_lift) apply (subgoal_tac "obj_ref_of (fst x) = capEPPtr (fst y)") prefer 2 apply (clarsimp simp: is_cap_simps) apply (simp add: split_def) apply (wp hoare_vcg_const_Ball_lift) apply (rule_tac P="slots = []" and Q="slots \<noteq> []" in corres_disj_division) apply simp apply (rule corres_trivial, simp add: returnOk_def) apply (case_tac mi, simp) apply (simp add: list_case_If2 split del: if_split) apply (rule corres_splitEE) apply (rule unifyFailure_discard2) apply (case_tac mi, clarsimp) apply (rule deriveCap_corres) apply (simp add: remove_rights_def) apply clarsimp apply (rule corres_split_norE) apply (rule corres_whenE) apply (case_tac cap', auto)[1] apply (rule corres_trivial, simp) apply (case_tac mi, simp) apply simp apply (simp add: liftE_bindE) apply (rule corres_split_nor) apply (rule cteInsert_corres, simp_all add: hd_map)[1] apply (simp add: tl_map) apply (rule corres_rel_imp, rule Cons.hyps, simp_all)[1] apply (wp valid_case_option_post_wp hoare_vcg_const_Ball_lift
                       hoare_vcg_const_Ball_lift cap_insert_weak_cte_wp_at) apply (wp hoare_vcg_const_Ball_lift | simp add:split_def del: imp_disj1)+ apply (wp cap_insert_cte_wp_at) apply (wp valid_case_option_post_wp hoare_vcg_const_Ball_lift
                     cteInsert_valid_pspace
                     | simp add: split_def)+ apply (wp cteInsert_weak_cte_wp_at hoare_valid_ipc_buffer_ptr_typ_at')+ apply (wpsimp wp: hoare_vcg_const_Ball_lift cteInsert_cte_wp_at  valid_case_option_post_wp
                      simp: split_def) apply (unfold whenE_def) apply wp+ apply (clarsimp simp: conj_comms ball_conj_distrib split del: if_split) apply (rule_tac Q' ="\<lambda>cap' s. (cap'\<noteq> cap.NullCap \<longrightarrow>
         cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s
         \<and> QM s cap')" for QM
         in hoare_post_imp_R) prefer 2 apply clarsimp apply assumption apply (subst imp_conjR) apply (rule hoare_vcg_conj_liftE_R) apply (rule derive_cap_is_derived) apply (wp derive_cap_is_derived_foo)+ apply (simp split del: if_split) apply (rule_tac Q' ="\<lambda>cap' s. (cap'\<noteq> capability.NullCap \<longrightarrow>
         cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap c)) (cte_map (a, b)) s
         \<and> QM s cap')" for QM
        in hoare_post_imp_R) prefer 2 apply clarsimp apply assumption apply (subst imp_conjR) apply (rule hoare_vcg_conj_liftE_R) apply (rule hoare_post_imp_R[OF deriveCap_derived]) apply (clarsimp simp:cte_wp_at_ctes_of) apply (wp deriveCap_derived_foo) apply (clarsimp simp: cte_wp_at_caps_of_state remove_rights_def
                           real_cte_tcb_valid if_apply_def2
                split del: if_split) apply (rule conjI, (clarsimp split del: if_split)+) apply (clarsimp simp:conj_comms split del:if_split) apply (intro conjI allI) apply (clarsimp split:if_splits) apply (case_tac "cap = fst x",simp+) apply (clarsimp simp:masked_as_full_def is_cap_simps cap_master_cap_simps) apply (clarsimp split del: if_split) apply (intro conjI) apply (clarsimp simp:neq_Nil_conv) apply (drule hd_in_set) apply (drule(1) bspec) apply (clarsimp split:if_split_asm) apply (fastforce simp:neq_Nil_conv) apply (intro ballI conjI) apply (clarsimp simp:neq_Nil_conv) apply (intro impI) apply (drule(1) bspec[OF _ subsetD[rotated]]) apply (clarsimp simp:neq_Nil_conv) apply (clarsimp split:if_splits) apply clarsimp apply (intro conjI) apply (drule(1) bspec,clarsimp)+ subgoal for \<dots> aa _ _ capa by (case_tac "capa = aa"; clarsimp split:if_splits simp:masked_as_full_def is_cap_simps) apply (case_tac "isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y)") apply (clarsimp simp:conj_comms split del:if_split) apply (subst if_not_P) apply clarsimp apply (clarsimp simp:valid_pspace'_def cte_wp_at_ctes_of split del:if_split) apply (intro conjI) apply (case_tac  "cteCap cte = fst y",clarsimp simp: badge_derived'_def) apply (clarsimp simp: maskCapRights_eq_null maskedAsFull_def badge_derived'_def isCap_simps
                     split: if_split_asm) apply (clarsimp split del: if_split) apply (case_tac "fst y = capability.NullCap") apply (clarsimp simp: neq_Nil_conv split del: if_split)+ apply (intro allI impI conjI) apply (clarsimp split:if_splits) apply (clarsimp simp:image_def)+ apply (thin_tac "\<forall>x\<in>set ys. Q x" for Q) apply (drule(1) bspec)+ apply clarsimp+ apply (drule(1) bspec) apply (rule conjI) apply clarsimp+ apply (case_tac "cteCap cteb = ab") by (clarsimp simp: isCap_simps maskedAsFull_def split:if_splits)+ qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>list_all2 (\<lambda>(cap, slot) (cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) caps caps'; mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set caps. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set caps'. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length caps' < unat max_ipc_words) (transfer_caps_loop ep buffer n caps slots mi) (transferCapsToSlots ep buffer n caps' (map cte_map slots) mi') proof (state)
goal (2 subgoals):
 1. \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set []. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set []. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length [] < unat max_ipc_words) (transfer_caps_loop ep buffer n [] slots mi) (transferCapsToSlots ep buffer n [] (map cte_map slots) mi')
 2. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (state)
this:
mi' = message_info_map mi

goal (2 subgoals):
 1. \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set []. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set []. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length [] < unat max_ipc_words) (transfer_caps_loop ep buffer n [] slots mi) (transferCapsToSlots ep buffer n [] (map cte_map slots) mi')
 2. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (prove)
goal (1 subgoal):
 1. corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length [] < unat max_ipc_words) (transfer_caps_loop ep buffer n [] slots mi) (transferCapsToSlots ep buffer n [] (map cte_map slots) mi') proof (prove)
using this:
mi' = message_info_map mi

goal (1 subgoal):
 1. corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length [] < unat max_ipc_words) (transfer_caps_loop ep buffer n [] slots mi) (transferCapsToSlots ep buffer n [] (map cte_map slots) mi') proof (state)
this:
corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set []. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length [] < unat max_ipc_words) (transfer_caps_loop ep buffer n [] slots mi) (transferCapsToSlots ep buffer n [] (map cte_map slots) mi')

goal (1 subgoal):
 1. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (state)
goal (1 subgoal):
 1. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (state)
this:
list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys
(case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y
?mi' = message_info_map ?mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set ?slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set xs. case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct ?slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map ?slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map ?slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + ?n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer ?n xs ?slots ?mi) (transferCapsToSlots ep buffer ?n ys (map cte_map ?slots) ?mi')
mi' = message_info_map mi

goal (1 subgoal):
 1. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (state)
this:
?b = ?c \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?x else ?y)
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (1 subgoal):
 1. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (state)
this:
(case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y

goal (1 subgoal):
 1. \<And>x xs y ys slots n mi mi'. \<lbrakk>list_all2 (\<lambda>a. case a of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) xs ys; (case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y; \<And>slots n mi mi'. mi' = message_info_map mi \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set xs. s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set ys. valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length ys < unat max_ipc_words) (transfer_caps_loop ep buffer n xs slots mi) (transferCapsToSlots ep buffer n ys (map cte_map slots) mi'); mi' = message_info_map mi\<rbrakk> \<Longrightarrow> corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>(cap, slot)\<in>set (x # xs). s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>(cap, slot)\<in>set (y # ys). valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (prove)
goal (1 subgoal):
 1. corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (x # xs). case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set (y # ys). case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (prove)
using this:
mi' = message_info_map mi
(case x of (cap, slot) \<Rightarrow> \<lambda>(cap', slot'). cap_relation cap cap' \<and> slot' = cte_map slot) y

goal (1 subgoal):
 1. corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (x # xs). case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set (y # ys). case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi') proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa\<rbrakk> \<Longrightarrow> corres (\<lambda>a. (=) (message_info_map a)) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. case x of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) (const_on_failure (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)) (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then doE y <- liftE (set_extra_badge buffer (cap_ep_badge xa) n);
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
odE else if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
y <- liftE (cap_insert cap' (a, b) (hd slots));
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) (let transferAgain = transferCapsToSlots ep buffer (Suc n) ys in constOnFailure (msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then doE y <- liftE (setExtraBadge buffer (capEPBadge xaa) n);
liftE (transferAgain (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
odE else case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferAgain slots' (message_info_map mi)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa\<rbrakk> \<Longrightarrow> corres (\<lambda>a. (=) (message_info_map a)) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) (const_on_failure (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)) (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then do y <- set_extra_badge buffer (cap_ep_badge xa) n;
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
od else if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)))) (constOnFailure (msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then do y <- setExtraBadge buffer (capEPBadge xaa) n;
liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
od else case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. message_info_map (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi)) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then do y <- set_extra_badge buffer (cap_ep_badge xa) n;
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
od else if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then do y <- setExtraBadge buffer (capEPBadge xaa) n;
liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
od else case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then do y <- set_extra_badge buffer (cap_ep_badge xa) n;
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
od else if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then do y <- setExtraBadge buffer (capEPBadge xaa) n;
liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
od else case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE) proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q21 xa a b xaa) (?Q'21 xa a b xaa) (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then do y <- set_extra_badge buffer (cap_ep_badge xa) n;
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
od else if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then do y <- setExtraBadge buffer (capEPBadge xaa) n;
liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
od else case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> ?Q21 xa a b xaa s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> ?Q'21 xa a b xaa s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa\<rbrakk> \<Longrightarrow> (is_ep_cap xa \<and> ep = Some (obj_ref_of xa)) = (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?P25 xa a b xaa) (?P'25 xa a b xaa) (do y <- set_extra_badge buffer (cap_ep_badge xa) n;
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
od) (do y <- setExtraBadge buffer (capEPBadge xaa) n;
liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
od)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then ?P25 xa a b xaa else ?Q25 xa a b xaa) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then ?P'25 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?P25 xa a b xaa) (?P'25 xa a b xaa) (do y <- set_extra_badge buffer (cap_ep_badge xa) n;
liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))
od) (do y <- setExtraBadge buffer (capEPBadge xaa) n;
liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
od)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then ?P25 xa a b xaa else ?Q25 xa a b xaa) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then ?P'25 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (7 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> capEPBadge xaa = cap_ep_badge xa
 2. \<And>xa a b xaa ya yaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa); dc ya yaa\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R89 xa a b xaa ya) (?R'89 xa a b xaa yaa) (liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))) (liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi))))
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>?R89 xa a b xaa\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>?R'89 xa a b xaa\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa ya yaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa); dc ya yaa\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R89 xa a b xaa ya) (?R'89 xa a b xaa yaa) (liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))) (liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi))))
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>?R89 xa a b xaa\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>?R'89 xa a b xaa\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa ya yaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; dc ya yaa; is_ep_cap xa\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R89 xa a b xaa ya) (?R'89 xa a b xaa yaa) (liftE (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)))) (liftE (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi))))
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>?R89 xa a b xaa\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>?R'89 xa a b xaa\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa\<rbrakk> \<Longrightarrow> corres (\<lambda>a. (=) (message_info_map a)) (?R89 xa a b xaa ()) (?R'89 xa a b xaa ()) (transfer_caps_loop ep buffer (Suc n) xs slots (Structures_A.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi))) (transferCapsToSlots ep buffer (Suc n) ys (map cte_map slots) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi)))
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>?R89 xa a b xaa\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>?R'89 xa a b xaa\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa\<rbrakk> \<Longrightarrow> msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_map mi) || 2 ^ n) (message_info_map mi) = Types_H.message_info.MI (mi_length mi) (mi_extra_caps mi) (mi_caps_unwrapped mi || 2 ^ n) (mi_label mi)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>\<lambda>a b. valid_objs b \<and> pspace_aligned b \<and> pspace_distinct b \<and> valid_mdb b \<and> valid_list b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x b) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x b \<and> real_cte_at x b) \<and> (\<forall>a\<in>set xs. case a of (cap, slot) \<Rightarrow> b \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot b) \<and> distinct slots \<and> in_user_frame buffer b\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>\<lambda>a b. valid_objs b \<and> pspace_aligned b \<and> pspace_distinct b \<and> valid_mdb b \<and> valid_list b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x b) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x b \<and> real_cte_at x b) \<and> (\<forall>a\<in>set xs. case a of (cap, slot) \<Rightarrow> b \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot b) \<and> distinct slots \<and> in_user_frame buffer b\<rbrace>
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q89 xa a b xaa\<rbrace> set_extra_badge buffer (cap_ep_badge xa) n \<lbrace>\<lambda>a b. valid_objs b \<and> pspace_aligned b \<and> pspace_distinct b \<and> valid_mdb b \<and> valid_list b \<and> ep_at (obj_ref_of xa) b \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x b \<and> real_cte_at x b) \<and> (\<forall>x\<in>set xs. b \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) b) \<and> distinct slots \<and> in_user_frame buffer b\<rbrace>
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and ?Q89 xa a b xaa else ?Q25 xa a b xaa) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else ?Q25 xa a b xaa) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa); obj_ref_of (fst x) = capEPPtr (fst y)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> obj_ref_of (fst x) = capEPPtr (fst y)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else ?Q25 xa a b xaa) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa)\<rbrakk> \<Longrightarrow> obj_ref_of (fst x) = capEPPtr (fst y)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa); obj_ref_of (fst x) = capEPPtr (fst y)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else ?Q25 xa a b xaa) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (obj_ref_of xa); obj_ref_of (fst x) = capEPPtr (fst y)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x b) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x b \<and> real_cte_at' x b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap b \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot b) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else ?Q25 xa a b xaa) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; is_ep_cap xa \<and> ep = Some (capEPPtr xaa); obj_ref_of xa = capEPPtr xaa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 xa a b xaa\<rbrace> setExtraBadge buffer (capEPBadge xaa) n \<lbrace>\<lambda>a b. valid_pspace' b \<and> ep_at' (capEPPtr xaa) b \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) b \<and> real_cte_at' (cte_map x) b) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer b \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) b \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) b) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrace>
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else ?Q25 xa a b xaa) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?Q'89 xa a b xaa else ?Q'25 xa a b xaa) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?Q25 xa a b xaa) (?Q'25 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else ?Q25 xa a b xaa) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else ?Q'25 xa a b xaa) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)\<rbrakk> \<Longrightarrow> slots = [] \<or> slots \<noteq> []
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep); slots = []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R170 xa a b xaa) (?S170 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?T170 xa a b xaa) (?U170 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> ?R170 xa a b xaa s) \<and> (slots \<noteq> [] \<longrightarrow> ?T170 xa a b xaa s))) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> ?S170 xa a b xaa s) \<and> (slots \<noteq> [] \<longrightarrow> ?U170 xa a b xaa s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep); slots = []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R170 xa a b xaa) (?S170 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?T170 xa a b xaa) (?U170 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> ?R170 xa a b xaa s) \<and> (slots \<noteq> [] \<longrightarrow> ?T170 xa a b xaa s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> ?S170 xa a b xaa s) \<and> (slots \<noteq> [] \<longrightarrow> ?U170 xa a b xaa s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots = []\<rbrakk> \<Longrightarrow> (\<exists>s s'. (s, s') \<in> state_relation) \<longrightarrow> Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?T170 xa a b xaa) (?U170 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> ?T170 xa a b xaa s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> ?U170 xa a b xaa s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep); slots \<noteq> []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?T170 xa a b xaa) (?U170 xa a b xaa) (if slots \<noteq> [] then doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE else returnOk (Structures_A.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi))) (case map cte_map slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) (message_info_map mi) | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (cte_map (a, b)) $ xaa;
whenE (isNullCap cap') $ throw ();
withoutFailure $ cteInsert cap' (cte_map (a, b)) destSlot;
withoutFailure $ transferCapsToSlots ep buffer (Suc n) ys slots' (message_info_map mi)
odE)
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> ?T170 xa a b xaa s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> ?U170 xa a b xaa s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?T170 xa a b xaa) (?U170 xa a b xaa) (doE cap' <- derive_cap (a, b) xa;
y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE cap' <- unifyFailure (global.deriveCap (cte_map (a, b)) xaa);
y <- whenE (cap' = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap' (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> ?T170 xa a b xaa s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> ?U170 xa a b xaa s))) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> ?r'174 xa a b xaa) (?P174 xa a b xaa) (?P'174 xa a b xaa) (derive_cap (a, b) xa) (unifyFailure (global.deriveCap (cte_map (a, b)) xaa))
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; ?r'174 xa a b xaa cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R174 xa a b xaa cap') (?R'174 xa a b xaa cap'a) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE y <- whenE (cap'a = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>?R174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>?R'174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (?P174 xa a b xaa and ?Q174 xa a b xaa) s))) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (?P'174 xa a b xaa and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (7 subgoals):
 1. \<And>xa a b xaa ft ft'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; ?f'179 xa a b xaa ft ft'\<rbrakk> \<Longrightarrow> Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> corres (?f'179 xa a b xaa \<oplus> ?r'174 xa a b xaa) (?P174 xa a b xaa) (?P'174 xa a b xaa) (derive_cap (a, b) xa) (global.deriveCap (cte_map (a, b)) xaa)
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; ?r'174 xa a b xaa cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R174 xa a b xaa cap') (?R'174 xa a b xaa cap'a) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE y <- whenE (cap'a = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>?R174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>?R'174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (?P174 xa a b xaa and ?Q174 xa a b xaa) s))) s
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (?P'174 xa a b xaa and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> corres (?f'179 xa a b xaa \<oplus> ?r'174 xa a b xaa) (?P174 xa a b xaa) (?P'174 xa a b xaa) (derive_cap (a, b) xa) (global.deriveCap (cte_map (a, b)) xaa)
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; ?r'174 xa a b xaa cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R174 xa a b xaa cap') (?R'174 xa a b xaa cap'a) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE y <- whenE (cap'a = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>?R174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>?R'174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (?P174 xa a b xaa and ?Q174 xa a b xaa) s))) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (?P'174 xa a b xaa and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (7 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> cap_relation xa xaa
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> cte_map (a, b) = cte_map (a, b)
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R174 xa a b xaa cap') (?R'174 xa a b xaa cap'a) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE y <- whenE (cap'a = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>?R174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>?R'174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> cte_map (a, b) = cte_map (a, b)
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R174 xa a b xaa cap') (?R'174 xa a b xaa cap'a) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE y <- whenE (cap'a = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>?R174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>?R'174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R174 xa a b xaa cap') (?R'174 xa a b xaa cap'a) (doE y <- whenE (cap' = cap.NullCap) (throwError undefined);
do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od
odE) (doE y <- whenE (cap'a = capability.NullCap) (throwError ());
y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>?R174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>?R'174 xa a b xaa\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (8 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> dc) (?P187 xa a b xaa cap') (?P'189 xa a b xaa cap'a) (whenE (cap' = cap.NullCap) (throwError undefined)) (whenE (cap'a = capability.NullCap) (throwError ()))
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (doE y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. ?P187 xa a b xaa cap' and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. ?P'189 xa a b xaa cap'a and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (10 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> (cap' = cap.NullCap) = (cap'a = capability.NullCap)
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> dc) (?P197 xa a b xaa cap') (?P'199 xa a b xaa cap'a) (throwError undefined) (throwError ())
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> dc () ()
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (doE y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> ?P197 xa a b xaa cap' s) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> ?P'199 xa a b xaa cap'a s) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 10. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (9 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> dc) (?P197 xa a b xaa cap') (?P'199 xa a b xaa cap'a) (throwError undefined) (throwError ())
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (doE y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> ?P197 xa a b xaa cap' s) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> ?P'199 xa a b xaa cap'a s) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (9 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> (\<exists>s s'. (s, s') \<in> state_relation) \<longrightarrow> Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> dc () ()
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (doE y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (8 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> dc () ()
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (doE y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (7 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (doE y <- liftE (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
odE)
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (7 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R186 xa a b xaa cap' cap'a) (?R'186 xa a b xaa cap' cap'a) (do y <- cap_insert cap' (a, b) (hd slots);
liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)
od) (do y <- cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots));
liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi))
od)
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?R186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?R'186 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (10 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres dc (?P215 xa a b xaa cap' cap'a) (?P'215 xa a b xaa cap' cap'a) (cap_insert cap' (a, b) (hd slots)) (cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)))
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R215 xa a b xaa cap' cap'a) (?R'215 xa a b xaa cap' cap'a) (liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)) (liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi)))
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q215 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>x. ?R215 xa a b xaa cap' cap'a\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x. ?R'215 xa a b xaa cap' cap'a\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. ?P215 xa a b xaa cap' cap'a and ?Q215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. ?P'215 xa a b xaa cap' cap'a and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 10. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (9 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres ((\<lambda>_ _. Types_H.message_info.MI (mi_length mi) (word_of_nat n) (mi_caps_unwrapped mi) (mi_label mi) = msgExtraCaps_update (\<lambda>_. word_of_nat n) (message_info_map mi)) \<oplus> (\<lambda>a. (=) (message_info_map a))) (?R215 xa a b xaa cap' cap'a) (?R'215 xa a b xaa cap' cap'a) (liftE (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi)) (liftE (transferCapsToSlots ep buffer (Suc n) ys (tl (map cte_map slots)) (message_info_map mi)))
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q215 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>x. ?R215 xa a b xaa cap' cap'a\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x. ?R'215 xa a b xaa cap' cap'a\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and ?Q215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (9 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> corres (\<lambda>a. (=) (message_info_map a)) (?R215 xa a b xaa cap' cap'a) (?R'215 xa a b xaa cap' cap'a) (transfer_caps_loop ep buffer (Suc n) xs (tl slots) mi) (transferCapsToSlots ep buffer (Suc n) ys (map cte_map (tl slots)) (message_info_map mi))
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q215 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>x. ?R215 xa a b xaa cap' cap'a\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x. ?R'215 xa a b xaa cap' cap'a\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and ?Q215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (8 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q215 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>x s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set xs. case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct (tl slots) \<and> in_user_frame buffer s\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and ?Q215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (9 subgoals):
 1. \<And>xa a b xaa cap' cap'a xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a; xb \<in> set xs\<rbrakk> \<Longrightarrow> \<lbrace>?P253 xa a b xaa cap' cap'a xb\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>rv s. case xb of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'252 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>rv s. distinct (tl slots) \<and> in_user_frame buffer s\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>xb. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>xb\<in>set xs. ?P253 xa a b xaa cap' cap'a xb s) \<and> ?P'252 xa a b xaa cap' cap'a s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (9 subgoals):
 1. \<And>xa a b xaa cap' cap'a xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a; xb \<in> set xs\<rbrakk> \<Longrightarrow> \<lbrace>?P'256 xa a b xaa cap' cap'a xb\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>rv. cte_wp_at (\<lambda>cp'. fst xb \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst xb \<longrightarrow> cp' = masked_as_full (fst xb) (fst xb)) (snd xb)\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'252 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>rv s. distinct (tl slots) \<and> in_user_frame buffer s\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>xb. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>xb\<in>set xs. s \<turnstile> fst xb \<and> ?P'256 xa a b xaa cap' cap'a xb s) \<and> ?P'252 xa a b xaa cap' cap'a s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 9. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (8 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'252 xa a b xaa cap' cap'a\<rbrace> cap_insert cap' (a, b) (hd slots) \<lbrace>\<lambda>rv s. distinct (tl slots) \<and> in_user_frame buffer s\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'215 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>x s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>xb. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> valid_mdb s \<and> valid_objs s \<and> (if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> ?P'252 xa a b xaa cap' cap'a s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and ?Q'215 xa a b xaa cap' cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (8 subgoals):
 1. \<And>xa a b xaa cap' cap'a xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a; xb \<in> cte_map ` set (tl slots)\<rbrakk> \<Longrightarrow> \<lbrace>?P274 xa a b xaa cap' cap'a xb\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) xb s \<and> real_cte_at' xb s\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'273 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>rv s. distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> valid_mdb s \<and> valid_objs s \<and> (if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> distinct (tl slots) \<and> in_user_frame buffer s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>xb. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and (\<lambda>s. (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>xb\<in>set (map cte_map (tl slots)). ?P274 xa a b xaa cap' cap'a xb s) \<and> ?P'273 xa a b xaa cap' cap'a s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 8. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (7 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?P'287 xa a b xaa cap' cap'a\<rbrace> cteInsert cap'a (cte_map (a, b)) (hd (map cte_map slots)) \<lbrace>\<lambda>rv s. (\<forall>a\<in>set ys. case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> valid_mdb s \<and> valid_objs s \<and> (if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> distinct (tl slots) \<and> in_user_frame buffer s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>xb. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and (\<lambda>s. (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> ?P'287 xa a b xaa cap' cap'a s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 7. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> whenE (cap' = cap.NullCap) (throwError undefined) \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> valid_mdb s \<and> valid_objs s \<and> (if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> distinct (tl slots) \<and> in_user_frame buffer s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> whenE (cap'a = capability.NullCap) (throwError ()) \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and (\<lambda>s. (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q188 xa a b xaa cap'\<rbrace> if cap' = cap.NullCap then throwError undefined else returnOk () \<lbrace>\<lambda>x. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((a, b) \<noteq> hd slots) and cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and (\<lambda>s. (valid_objs and valid_cap cap' and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and valid_cap cap' and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> valid_mdb s \<and> valid_objs s \<and> (if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> distinct (tl slots) \<and> in_user_frame buffer s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>xa a b xaa cap' cap'a. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; cap_relation cap' cap'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'190 xa a b xaa cap'a\<rbrace> if cap'a = capability.NullCap then throwError () else returnOk () \<lbrace>\<lambda>x. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' cap'a and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) and (\<lambda>s. (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q174 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap'. (\<lambda>s. cap' = cap.NullCap \<longrightarrow> True) and ?Q188 xa a b xaa cap'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and ?Q'190 xa a b xaa cap'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and ?Q174 xa a b xaa) s))) s
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'355 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. (cap' = cap.NullCap \<longrightarrow> True) \<and> True \<and> (cap' = cap.NullCap \<longrightarrow> True) \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> K ((a, b) \<noteq> hd slots) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> (valid_objs and (\<lambda>a. a \<turnstile> cap') and tcb_cap_valid cap' (hd slots)) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> (valid_mdb and (\<lambda>a. a \<turnstile> cap') and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) and K ((a, b) \<noteq> hd slots)) s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set (tl slots). (if x = hd slots then cap' = cap.NullCap else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> valid_mdb s \<and> valid_objs s \<and> (if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)) \<and> distinct (tl slots) \<and> in_user_frame buffer s)\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'355 xa a b xaa s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'355 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). if x = hd slots then False else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) \<and> (\<forall>x\<in>set xs. if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'355 xa a b xaa s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'355 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> ?QM384 xa a b xaa s cap'\<rbrace>, -
 2. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s \<and> ?QM384 xa a b xaa s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> rv \<and> distinct (tl slots) \<and> tcb_cap_valid rv (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). if x = hd slots then False else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s) \<and> (\<forall>x\<in>set xs. if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'355 xa a b xaa s)) s))) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s \<and> ?QM384 xa a b xaa s rv\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> rv \<and> distinct (tl slots) \<and> tcb_cap_valid rv (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). if x = hd slots then False else x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s) \<and> (\<forall>x\<in>set xs. if snd x = hd slots then fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x) else cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s)
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'355 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> ?QM384 xa a b xaa s cap'\<rbrace>, -
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'355 xa a b xaa s)) s))) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> cap.NullCap; cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s; ?QM384 xa a b xaa s rv\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> rv \<and> distinct (tl slots) \<and> tcb_cap_valid rv (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s))
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'355 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> ?QM384 xa a b xaa s cap'\<rbrace>, -
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'355 xa a b xaa s)) s))) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'355 xa a b xaa\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s))\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'355 xa a b xaa s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'408 xa xa a a b b xaa (?xa407 xa a b xaa)\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>cap' s. (cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) cap') (a, b) s) \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) s)))\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ?P'408 xa xa a a b b xaa (?xa407 xa a b xaa) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P414 xa xa a a b b xaa (?xa407 xa a b xaa)\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>rv s. rv \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (is_derived (cdt s) (a, b) rv) (a, b) s\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q413 xa xa a a b b xaa (?xa407 xa a b xaa)\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>rv s. rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> rv \<and> distinct (tl slots) \<and> tcb_cap_valid rv (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s))\<rbrace>, -
 3. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> (?P414 xa xa a a b b xaa (?xa407 xa a b xaa) and ?Q413 xa xa a a b b xaa (?xa407 xa a b xaa)) s)) s))) s
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q413 xa xa a a b b xaa (?xa407 xa a b xaa)\<rbrace> derive_cap (a, b) xa \<lbrace>\<lambda>rv s. rv \<noteq> cap.NullCap \<longrightarrow> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_objs s \<and> in_user_frame buffer s \<and> s \<turnstile> rv \<and> distinct (tl slots) \<and> tcb_cap_valid rv (hd slots) s \<and> valid_list s \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb s) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c rv \<noteq> fst x \<longrightarrow> masked_as_full c rv = masked_as_full (fst x) (fst x)) (snd x) s))\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q'174 xa a b xaa\<rbrace> unifyFailure (global.deriveCap (cte_map (a, b)) xaa) \<lbrace>\<lambda>cap'a. (\<lambda>s. cap'a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and ?Q413 xa xa a a b b xaa (?xa407 xa a b xaa)) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and ?Q'174 xa a b xaa) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'427 xa a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap'a s. (cap'a = capability.NullCap \<longrightarrow> True) \<and> True \<and> (cap'a = capability.NullCap \<longrightarrow> True) \<and> (cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> (valid_pspace' and valid_cap' cap'a and (\<lambda>s. cte_map (a, b) \<noteq> hd (map cte_map slots)) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) cap'a \<circ> cteCap) (cte_map (a, b)) s)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map (tl slots)). (if x = hd (map cte_map slots) then cap'a = capability.NullCap else x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s) \<and> real_cte_at' x s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> 2 + msg_max_length + Suc n + length ys < unat max_ipc_words)\<rbrace>, -
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'427 xa a b xaa s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'427 xa a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap'a s. cap'a \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap'a s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' cap'a s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). (if cte_map x = hd (map cte_map slots) then False else cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s) \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap'a (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> cap'a \<noteq> fst x \<longrightarrow> cap'a = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap'a \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap'a = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrace>, -
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'427 xa a b xaa s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'427 xa a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap' s. cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap c)) (cte_map (a, b)) s \<and> ?QM444 xa a b xaa s cap'\<rbrace>, -
 2. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s \<and> ?QM444 xa a b xaa s rv\<rbrakk> \<Longrightarrow> rv \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' rv s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). (if cte_map x = hd (map cte_map slots) then False else cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s) \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) rv \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) rv = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'427 xa a b xaa s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s \<and> ?QM444 xa a b xaa s rv\<rbrakk> \<Longrightarrow> rv \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' rv s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). (if cte_map x = hd (map cte_map slots) then False else cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s) \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (if snd x = hd (map cte_map slots) then fst x \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = maskedAsFull (fst x) (fst x) else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) rv \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) rv = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'427 xa a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap' s. cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap c)) (cte_map (a, b)) s \<and> ?QM444 xa a b xaa s cap'\<rbrace>, -
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'427 xa a b xaa s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> capability.NullCap; cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s; ?QM444 xa a b xaa s rv\<rbrakk> \<Longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' rv s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) rv \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) rv = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'427 xa a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap' s. cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap c)) (cte_map (a, b)) s \<and> ?QM444 xa a b xaa s cap'\<rbrace>, -
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'427 xa a b xaa s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'427 xa a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap' s. cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap c)) (cte_map (a, b)) s \<and> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' cap' s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrace>, -
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'427 xa a b xaa s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P'469 xa a b xaa (?xb469 xa a b xaa) a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>cap' s. (cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap c)) (cte_map (a, b)) s) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' cap' s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' cap' s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)\<rbrace>, -
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ?P'469 xa a b xaa (?xb469 xa a b xaa) a b xaa s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P475 xa a b xaa (?xb469 xa a b xaa) a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>rv s. rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s\<rbrace>, -
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q474 xa a b xaa (?xb469 xa a b xaa) a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>rv s. rv \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' rv s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) rv \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) rv = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrace>, -
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> (?P475 xa a b xaa (?xb469 xa a b xaa) a b xaa and ?Q474 xa a b xaa (?xb469 xa a b xaa) a b xaa) s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa rv s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []; rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (cte_map (a, b)) rv \<circ> cteCap) (cte_map (a, b)) s\<rbrakk> \<Longrightarrow> rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>c. is_derived' (ctes_of s) (cte_map (a, b)) rv (cteCap c)) (cte_map (a, b)) s
 2. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q474 xa a b xaa (?xb469 xa a b xaa) a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>rv s. rv \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' rv s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) rv \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) rv = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrace>, -
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and ?Q474 xa a b xaa (?xb469 xa a b xaa) a b xaa) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; isEndpointCap xaa \<longrightarrow> ep = None \<or> capEPPtr xaa \<noteq> the ep; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Q474 xa a b xaa (?xb469 xa a b xaa) a b xaa\<rbrace> global.deriveCap (cte_map (a, b)) xaa \<lbrace>\<lambda>rv s. rv \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) s \<and> valid_pspace' s \<and> valid_cap' rv s \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> rv \<noteq> fst x \<longrightarrow> rv = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) rv \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) rv = maskedAsFull (fst x) (fst x)) (snd x) s)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrace>, -
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and ?Q474 xa a b xaa (?xb469 xa a b xaa) a b xaa) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> s \<turnstile> xa \<and> cte_wp_at (\<lambda>cp'. xa \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> xa \<longrightarrow> cp' = masked_as_full xa xa) (a, b) s \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s\<rbrakk> \<Longrightarrow> (if is_ep_cap xa \<and> ep = Some (obj_ref_of xa) then in_user_frame buffer and (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> ep_at (obj_ref_of xa) s \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>x\<in>set xs. s \<turnstile> fst x \<and> cte_wp_at (\<lambda>cp'. fst x \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> fst x \<longrightarrow> cp' = masked_as_full (fst x) (fst x)) (snd x) s) \<and> distinct slots \<and> in_user_frame buffer s) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (cte_wp_at (\<lambda>_. True) (a, b) and (\<lambda>s. True \<and> ((\<lambda>c. xa \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>cap. cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) (a, b) c \<and> valid_objs c) and (\<lambda>c. \<forall>cap'. (cte_wp_at (\<lambda>capa. cap_master_cap capa = cap_master_cap xa \<and> (cap_badge capa, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid capa = cap_asid xa \<and> vs_cap_ref capa = vs_cap_ref xa) (a, b) c \<and> valid_objs c \<and> cap' \<noteq> cap.NullCap \<longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) c) \<and> (c \<turnstile> xa \<longrightarrow> c \<turnstile> cap') \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> pspace_aligned c \<and> pspace_distinct c \<and> valid_mdb c \<and> valid_objs c \<and> in_user_frame buffer c \<and> c \<turnstile> cap' \<and> distinct (tl slots) \<and> tcb_cap_valid cap' (hd slots) c \<and> valid_list c \<and> (a, b) \<noteq> hd slots \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (hd slots) c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x c) \<and> (\<forall>x\<in>set xs. c \<turnstile> fst x) \<and> (\<forall>x\<in>set (tl slots). real_cte_at x c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_mdb c) \<and> ((\<exists>a aa b. (a, aa, b) \<in> set xs) \<longrightarrow> valid_objs c) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> cte_wp_at (\<lambda>cap. cap = cap.NullCap) x c)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> cte_wp_at (\<lambda>c. fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full c cap' \<noteq> fst x \<longrightarrow> masked_as_full c cap' = masked_as_full (fst x) (fst x)) (snd x) c)))) s)) s))) s
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s\<rbrakk> \<Longrightarrow> (is_ep_cap xa \<and> ep = Some (obj_ref_of xa) \<longrightarrow> ep_at (obj_ref_of xa) s) \<and> ((is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa)) \<longrightarrow> slots \<noteq> [] \<longrightarrow> (xa \<noteq> cap.NullCap \<longrightarrow> cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))))))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> (xa \<noteq> cap.NullCap \<longrightarrow> cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False \<and> cap_asid cap = cap_asid xa \<and> vs_cap_ref cap = vs_cap_ref xa) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> xa \<noteq> cap.NullCap \<and> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> (xa \<noteq> cap.NullCap \<longrightarrow> vs_cap_ref cap = vs_cap_ref xa \<and> cap_asid cap = cap_asid xa \<and> cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False) \<and> (\<forall>cap'. s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap \<and> xa \<noteq> cap.NullCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> xa \<noteq> cap.NullCap \<longrightarrow> vs_cap_ref cap = vs_cap_ref xa \<and> cap_asid cap = cap_asid xa \<and> cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap \<and> xa \<noteq> cap.NullCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> vs_cap_ref cap = vs_cap_ref xa \<and> cap_asid cap = cap_asid xa \<and> cap_master_cap cap = cap_master_cap xa \<and> (cap_badge cap, cap_badge xa) \<in> capBadge_ordering False
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap \<and> xa \<noteq> cap.NullCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some (masked_as_full xa xa); distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; xa \<noteq> cap.NullCap; cap = masked_as_full xa xa; masked_as_full xa xa \<noteq> xa\<rbrakk> \<Longrightarrow> cap_master_cap (masked_as_full xa xa) = cap_master_cap xa \<and> (cap_badge (masked_as_full xa xa), cap_badge xa) \<in> capBadge_ordering False
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap \<and> xa \<noteq> cap.NullCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; xa \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []\<rbrakk> \<Longrightarrow> s \<turnstile> cap' \<and> (cap' \<noteq> cap.NullCap \<longrightarrow> \<not> is_zombie xa \<and> xa \<noteq> cap.IRQControlCap \<and> xa \<noteq> cap.NullCap) \<longrightarrow> cap' \<noteq> cap.NullCap \<longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> distinct (tl slots) \<and> (a, b) \<noteq> hd slots \<and> (\<forall>x\<in>set (tl slots). real_cte_at x s) \<and> (\<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)) \<and> (\<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x)))))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (6 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> distinct (tl slots)
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> (a, b) \<noteq> hd slots
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). real_cte_at x s
 4. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)
 5. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 6. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> (a, b) \<noteq> hd slots
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). real_cte_at x s
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)
 4. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; hd slots \<in> set slots\<rbrakk> \<Longrightarrow> (a, b) \<noteq> hd slots
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). real_cte_at x s
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)
 4. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (5 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; hd slots \<in> set slots; caps_of_state s (hd slots) = Some cap.NullCap \<and> real_cte_at (hd slots) s\<rbrakk> \<Longrightarrow> (a, b) \<noteq> hd slots
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). real_cte_at x s
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)
 4. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 5. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). real_cte_at x s
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (tl slots). x \<noteq> hd slots \<and> (x \<noteq> hd slots \<longrightarrow> x \<noteq> (a, b) \<and> caps_of_state s x = Some cap.NullCap)
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots)\<rbrakk> \<Longrightarrow> xb \<noteq> hd slots
 2. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots)\<rbrakk> \<Longrightarrow> xb \<noteq> hd slots \<longrightarrow> xb \<noteq> (a, b) \<and> caps_of_state s xb = Some cap.NullCap
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots)\<rbrakk> \<Longrightarrow> xb \<noteq> hd slots \<longrightarrow> xb \<noteq> (a, b) \<and> caps_of_state s xb = Some cap.NullCap
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots); xb \<noteq> hd slots\<rbrakk> \<Longrightarrow> xb \<noteq> (a, b) \<and> caps_of_state s xb = Some cap.NullCap
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (4 subgoals):
 1. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots); xb \<noteq> hd slots\<rbrakk> \<Longrightarrow> set (tl slots) \<subseteq> set slots
 2. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots); xb \<noteq> hd slots; caps_of_state s xb = Some cap.NullCap \<and> real_cte_at xb s\<rbrakk> \<Longrightarrow> xb \<noteq> (a, b) \<and> caps_of_state s xb = Some cap.NullCap
 3. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 4. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap cap' xb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; xb \<in> set (tl slots); xb \<noteq> hd slots; caps_of_state s xb = Some cap.NullCap \<and> real_cte_at xb s\<rbrakk> \<Longrightarrow> xb \<noteq> (a, b) \<and> caps_of_state s xb = Some cap.NullCap
 2. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs. (snd x = hd slots \<longrightarrow> fst x \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = masked_as_full (fst x) (fst x)) \<and> (snd x \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> fst x \<longrightarrow> masked_as_full cap cap' = masked_as_full (fst x) (fst x))))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap cap' aa ab ba. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; (aa, ab, ba) \<in> set xs\<rbrakk> \<Longrightarrow> ((ab, ba) = hd slots \<longrightarrow> aa \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> aa \<longrightarrow> cap' = masked_as_full aa aa) \<and> ((ab, ba) \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (ab, ba) = Some cap \<and> (aa \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> aa \<longrightarrow> masked_as_full cap cap' = masked_as_full aa aa)))
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cap cap' aa ab ba. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; (aa, ab, ba) \<in> set xs\<rbrakk> \<Longrightarrow> (ab, ba) = hd slots \<longrightarrow> aa \<noteq> cap.NullCap \<longrightarrow> cap' \<noteq> aa \<longrightarrow> cap' = masked_as_full aa aa
 2. \<And>xa a b xaa s cap cap' aa ab ba. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; \<forall>x\<in>set xs. s \<turnstile> fst x \<and> (\<exists>cap. caps_of_state s (snd x) = Some cap \<and> (fst x \<noteq> cap.NullCap \<longrightarrow> cap \<noteq> fst x \<longrightarrow> cap = masked_as_full (fst x) (fst x))); caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; (aa, ab, ba) \<in> set xs\<rbrakk> \<Longrightarrow> (ab, ba) \<noteq> hd slots \<longrightarrow> (\<exists>cap. caps_of_state s (ab, ba) = Some cap \<and> (aa \<noteq> cap.NullCap \<longrightarrow> masked_as_full cap cap' \<noteq> aa \<longrightarrow> masked_as_full cap cap' = masked_as_full aa aa))
 3. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cap cap' aa ab ba capa. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_objs s; pspace_aligned s; pspace_distinct s; valid_mdb s; valid_list s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s; \<forall>x\<in>set slots. caps_of_state s x = Some cap.NullCap \<and> real_cte_at x s; s \<turnstile> xa; caps_of_state s (a, b) = Some cap; distinct slots; in_user_frame buffer s; is_ep_cap xa \<longrightarrow> ep \<noteq> Some (obj_ref_of xa); slots \<noteq> []; s \<turnstile> cap'; cap' \<noteq> cap.NullCap; \<not> is_zombie xa; xa \<noteq> cap.IRQControlCap; xa \<noteq> cap.NullCap; cap \<noteq> xa \<longrightarrow> cap = masked_as_full xa xa; (aa, ab, ba) \<in> set xs; s \<turnstile> aa; caps_of_state s (ab, ba) = Some capa; (ab, ba) \<noteq> hd slots; aa \<noteq> cap.NullCap; masked_as_full capa cap' \<noteq> aa; capa \<noteq> aa \<longrightarrow> capa = masked_as_full aa aa\<rbrakk> \<Longrightarrow> masked_as_full capa cap' = masked_as_full aa aa
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mi' = message_info_map mi; x = (xa_, a_, b_); y = (xaa_, cte_map (a_, b_)); cap_relation xa_ xaa_; valid_objs s_; pspace_aligned s_; pspace_distinct s_; valid_mdb s_; valid_list s_; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s_; \<forall>x\<in>set slots. caps_of_state s_ x = Some cap.NullCap \<and> real_cte_at x s_; s_ \<turnstile> xa_; caps_of_state s_ (a_, b_) = Some cap_; distinct slots; in_user_frame buffer s_; is_ep_cap xa_ \<longrightarrow> ep \<noteq> Some (obj_ref_of xa_); slots \<noteq> []; s_ \<turnstile> cap'_; cap'_ \<noteq> cap.NullCap; \<not> is_zombie xa_; xa_ \<noteq> cap.IRQControlCap; xa_ \<noteq> cap.NullCap; cap_ \<noteq> xa_ \<longrightarrow> cap_ = masked_as_full xa_ xa_; (aa, ab_, ba_) \<in> set xs; s_ \<turnstile> aa; caps_of_state s_ (ab_, ba_) = Some capa; (ab_, ba_) \<noteq> hd slots; aa \<noteq> cap.NullCap; masked_as_full capa cap'_ \<noteq> aa; capa \<noteq> aa \<longrightarrow> capa = masked_as_full aa aa\<rbrakk> \<Longrightarrow> masked_as_full capa cap'_ = masked_as_full aa aa proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y)\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; \<not> (isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y))\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; \<not> (isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y))\<rbrakk> \<Longrightarrow> (if isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep then valid_ipc_buffer_ptr' buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>s. valid_pspace' s \<and> ep_at' (capEPPtr xaa) s \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words) else (\<lambda>s. (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s))) s proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; \<not> (isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y))\<rbrakk> \<Longrightarrow> \<not> (isEndpointCap xaa \<and> (\<exists>y. ep = Some y) \<and> capEPPtr xaa = the ep)
 2. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; \<not> (isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y))\<rbrakk> \<Longrightarrow> (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (cte_map x) s \<and> real_cte_at' (cte_map x) s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> valid_cap' xaa s \<and> cte_wp_at' (\<lambda>cte. xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa) (cte_map (a, b)) s \<and> (\<forall>x\<in>set ys. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x)) (snd x) s) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; \<not> (isEndpointCap (fst y) \<and> capEPPtr (fst y) = the ep \<and> (\<exists>y. ep = Some y))\<rbrakk> \<Longrightarrow> (slots = [] \<longrightarrow> True) \<and> (slots \<noteq> [] \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and valid_mdb' and (\<lambda>s. True \<and> True \<and> ((\<lambda>c. xaa \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c) and (\<lambda>c. \<forall>cap'. (cte_wp_at' (\<lambda>cte. badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) (cte_map (a, b)) c \<and> valid_objs' c \<and> cap' \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of c) (cte_map (a, b)) cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (cte_wp_at' (untyped_derived_eq xaa \<circ> cteCap) (cte_map (a, b)) c \<longrightarrow> cte_wp_at' (untyped_derived_eq cap' \<circ> cteCap) (cte_map (a, b)) c) \<and> (valid_cap' xaa c \<longrightarrow> valid_cap' cap' c) \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> pspace_distinct' c \<and> pspace_aligned' c \<and> valid_mdb' c \<and> valid_cap' cap' c \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (hd (map cte_map slots)) c \<and> valid_pspace' c \<and> valid_cap' cap' c \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> valid_objs' c \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x c) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map x) c \<and> real_cte_at' (cte_map x) c)) \<and> distinct (map cte_map (tl slots)) \<and> valid_ipc_buffer_ptr' buffer c \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x))) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> valid_cap' (fst x) c \<and> valid_mdb' c \<and> valid_objs' c \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap c) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap c) cap' = maskedAsFull (fst x) (fst x)) (snd x) c)) \<and> Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words)) s)) s) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots \<noteq> []\<rbrakk> \<Longrightarrow> (xaa \<noteq> capability.NullCap \<longrightarrow> badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)) \<and> (\<forall>cap'. (badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<and> cap' \<noteq> capability.NullCap \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte)) \<and> (untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte)) \<and> valid_cap' cap' s \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots \<noteq> []\<rbrakk> \<Longrightarrow> xaa \<noteq> capability.NullCap \<longrightarrow> badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)
 2. \<And>xa a b xaa s cte. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>cap'. (badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<and> cap' \<noteq> capability.NullCap \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte)) \<and> (untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte)) \<and> valid_cap' cap' s \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x))))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots \<noteq> []; cteCap cte \<noteq> fst y\<rbrakk> \<Longrightarrow> xaa \<noteq> capability.NullCap \<longrightarrow> badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte)
 2. \<And>xa a b xaa s cte. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>cap'. (badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<and> cap' \<noteq> capability.NullCap \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte)) \<and> (untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte)) \<and> valid_cap' cap' s \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x))))) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; xaa \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots \<noteq> []\<rbrakk> \<Longrightarrow> \<forall>cap'. (badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<and> cap' \<noteq> capability.NullCap \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte)) \<and> (untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte)) \<and> valid_cap' cap' s \<and> (cap' \<noteq> capability.NullCap \<longrightarrow> xaa \<noteq> capability.NullCap) \<longrightarrow> cap' \<noteq> capability.NullCap \<longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x))))) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; slots \<noteq> []; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x))))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; slots \<noteq> []; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; fst y = capability.NullCap\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))))
 2. \<And>xa a b xaa s cte cap'. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; \<forall>x\<in>set slots. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; distinct (map cte_map slots); valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; slots \<noteq> []; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; fst y \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> (\<exists>cte. ctes_of s (hd (map cte_map slots)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> cte_map (a, b) \<noteq> hd (map cte_map slots) \<and> (\<forall>x\<in>set (tl slots). cte_map x \<noteq> hd (map cte_map slots) \<and> (cte_map x \<noteq> hd (map cte_map slots) \<longrightarrow> cte_map x \<noteq> cte_map (a, b) \<and> (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s)) \<and> distinct (map cte_map (tl slots)) \<and> (\<forall>x\<in>set ys. (snd x = hd (map cte_map slots) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> hd (map cte_map slots) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x))))) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> cte_map (a, b) \<noteq> cte_map (aa, ba) \<and> (\<forall>x\<in>set ysa. cte_map x \<noteq> cte_map (aa, ba) \<and> (cte_map x \<noteq> cte_map (aa, ba) \<longrightarrow> cte_map x \<noteq> cte_map (a, b))) \<and> (\<forall>x\<in>set ys. (snd x = cte_map (aa, ba) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x))))) proof (prove)
goal (3 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> cte_map (a, b) \<noteq> cte_map (aa, ba)
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ysa. cte_map x \<noteq> cte_map (aa, ba) \<and> (cte_map x \<noteq> cte_map (aa, ba) \<longrightarrow> cte_map x \<noteq> cte_map (a, b))
 3. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ys. (snd x = cte_map (aa, ba) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ysa. cte_map x \<noteq> cte_map (aa, ba) \<and> (cte_map x \<noteq> cte_map (aa, ba) \<longrightarrow> cte_map x \<noteq> cte_map (a, b))
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ys. (snd x = cte_map (aa, ba) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; \<forall>x\<in>set ysa. cte_map (aa, ba) \<noteq> cte_map x; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ysa\<rbrakk> \<Longrightarrow> cte_map (ab, bb) \<noteq> cte_map (aa, ba) \<and> (cte_map (ab, bb) \<noteq> cte_map (aa, ba) \<longrightarrow> cte_map (ab, bb) \<noteq> cte_map (a, b))
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ys. (snd x = cte_map (aa, ba) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; \<forall>x\<in>set ysa. cte_map (aa, ba) \<noteq> cte_map x; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ysa\<rbrakk> \<Longrightarrow> cte_map (ab, bb) \<noteq> cte_map (aa, ba) \<and> (cte_map (ab, bb) \<noteq> cte_map (aa, ba) \<longrightarrow> cte_map (ab, bb) \<noteq> cte_map (a, b))
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ys. (snd x = cte_map (aa, ba) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ysa; cte_map (aa, ba) \<noteq> cte_map (ab, bb); (\<exists>cte. ctes_of s (cte_map (ab, bb)) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map (ab, bb)) s\<rbrakk> \<Longrightarrow> cte_map (ab, bb) \<noteq> cte_map (aa, ba) \<and> (cte_map (ab, bb) \<noteq> cte_map (aa, ba) \<longrightarrow> cte_map (ab, bb) \<noteq> cte_map (a, b))
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>x\<in>set ys. (snd x = cte_map (aa, ba) \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> fst x \<longrightarrow> cap' = maskedAsFull (fst x) (fst x)) \<and> (snd x \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> fst x \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull (fst x) (fst x)))) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; \<forall>x\<in>set ys. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys\<rbrakk> \<Longrightarrow> (bb = cte_map (aa, ba) \<longrightarrow> ab \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> ab \<longrightarrow> cap' = maskedAsFull ab ab) \<and> (bb \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s bb = Some cte \<and> (ab \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> ab \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull ab ab))) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys; valid_cap' (fst (ab, bb)) s \<and> (\<exists>cte. ctes_of s (snd (ab, bb)) = Some cte \<and> (fst (ab, bb) \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst (ab, bb) \<longrightarrow> cteCap cte = maskedAsFull (fst (ab, bb)) (fst (ab, bb))))\<rbrakk> \<Longrightarrow> (bb = cte_map (aa, ba) \<longrightarrow> ab \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> ab \<longrightarrow> cap' = maskedAsFull ab ab) \<and> (bb \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s bb = Some cte \<and> (ab \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> ab \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull ab ab))) proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys; valid_cap' (fst (ab, bb)) s \<and> (\<exists>cte. ctes_of s (snd (ab, bb)) = Some cte \<and> (fst (ab, bb) \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst (ab, bb) \<longrightarrow> cteCap cte = maskedAsFull (fst (ab, bb)) (fst (ab, bb))))\<rbrakk> \<Longrightarrow> bb = cte_map (aa, ba) \<longrightarrow> ab \<noteq> capability.NullCap \<longrightarrow> cap' \<noteq> ab \<longrightarrow> cap' = maskedAsFull ab ab
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys; valid_cap' (fst (ab, bb)) s \<and> (\<exists>cte. ctes_of s (snd (ab, bb)) = Some cte \<and> (fst (ab, bb) \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst (ab, bb) \<longrightarrow> cteCap cte = maskedAsFull (fst (ab, bb)) (fst (ab, bb))))\<rbrakk> \<Longrightarrow> bb \<noteq> cte_map (aa, ba) \<longrightarrow> (\<exists>cte. ctes_of s bb = Some cte \<and> (ab \<noteq> capability.NullCap \<longrightarrow> maskedAsFull (cteCap cte) cap' \<noteq> ab \<longrightarrow> maskedAsFull (cteCap cte) cap' = maskedAsFull ab ab)) proof (prove)
goal (1 subgoal):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb cteb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys; valid_cap' ab s; ctes_of s bb = Some cteb; bb \<noteq> cte_map (aa, ba); ab \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) cap' \<noteq> ab; cteCap cteb \<noteq> ab \<longrightarrow> cteCap cteb = maskedAsFull ab ab\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) cap' = maskedAsFull ab ab proof (prove)
goal (2 subgoals):
 1. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb cteb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys; valid_cap' ab s; ctes_of s bb = Some cteb; bb \<noteq> cte_map (aa, ba); ab \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) cap' \<noteq> ab; cteCap cteb \<noteq> ab \<longrightarrow> cteCap cteb = maskedAsFull ab ab; cteCap cteb = ab\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) cap' = maskedAsFull ab ab
 2. \<And>xa a b xaa s cte cap' aa ba ysa ctea ab bb cteb. \<lbrakk>mi' = message_info_map mi; x = (xa, a, b); y = (xaa, cte_map (a, b)); cap_relation xa xaa; capEPPtr xaa = the ep \<longrightarrow> isEndpointCap xaa \<longrightarrow> ep = None; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s; valid_ipc_buffer_ptr' buffer s; valid_cap' xaa s; Suc (Suc (Suc (msg_max_length + n + length ys))) < unat max_ipc_words; ctes_of s (cte_map (a, b)) = Some cte; badge_derived' xaa (cteCap cte) \<and> capASID xaa = capASID (cteCap cte) \<and> cap_asid_base' xaa = cap_asid_base' (cteCap cte) \<and> cap_vptr' xaa = cap_vptr' (cteCap cte) \<longrightarrow> is_derived' (ctes_of s) (cte_map (a, b)) cap' (cteCap cte); untyped_derived_eq xaa (cteCap cte) \<longrightarrow> untyped_derived_eq cap' (cteCap cte); valid_cap' cap' s; cap' \<noteq> capability.NullCap; xaa \<noteq> capability.NullCap; cteCap cte \<noteq> xaa \<longrightarrow> cteCap cte = maskedAsFull xaa xaa; slots = (aa, ba) # ysa; cte_map (aa, ba) \<notin> cte_map ` set ysa; distinct (map cte_map ysa); real_cte_at' (cte_map (aa, ba)) s; \<forall>x\<in>set ysa. (\<exists>cte. ctes_of s (cte_map x) = Some cte \<and> cteCap cte = capability.NullCap) \<and> real_cte_at' (cte_map x) s; ctes_of s (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.NullCap; (ab, bb) \<in> set ys; valid_cap' ab s; ctes_of s bb = Some cteb; bb \<noteq> cte_map (aa, ba); ab \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) cap' \<noteq> ab; cteCap cteb \<noteq> ab \<longrightarrow> cteCap cteb = maskedAsFull ab ab; cteCap cteb \<noteq> ab\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) cap' = maskedAsFull ab ab proof (state)
this:
corres ((=) \<circ> message_info_map) (\<lambda>s. valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_mdb s \<and> valid_list s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at x s) \<and> (\<forall>x\<in>set slots. cte_wp_at (\<lambda>cap. cap = cap.NullCap) x s \<and> real_cte_at x s) \<and> (\<forall>a\<in>set (x # xs). case a of (cap, slot) \<Rightarrow> s \<turnstile> cap \<and> cte_wp_at (\<lambda>cp'. cap \<noteq> cap.NullCap \<longrightarrow> cp' \<noteq> cap \<longrightarrow> cp' = masked_as_full cap cap) slot s) \<and> distinct slots \<and> in_user_frame buffer s) (\<lambda>s. valid_pspace' s \<and> (case ep of None \<Rightarrow> True | Some x \<Rightarrow> ep_at' x s) \<and> (\<forall>x\<in>set (map cte_map slots). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x s \<and> real_cte_at' x s) \<and> distinct (map cte_map slots) \<and> valid_ipc_buffer_ptr' buffer s \<and> (\<forall>a\<in>set (y # ys). case a of (cap, slot) \<Rightarrow> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. cap \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> cap \<longrightarrow> cteCap cte = maskedAsFull cap cap) slot s) \<and> 2 + msg_max_length + n + length (y # ys) < unat max_ipc_words) (transfer_caps_loop ep buffer n (x # xs) slots mi) (transferCapsToSlots ep buffer n (y # ys) (map cte_map slots) mi')

goal:
No subgoals!